From 071b7e9b01e41d4048b1bbb3d9caaac4c8a526de Mon Sep 17 00:00:00 2001 From: Anders Betts Date: Thu, 17 Sep 2026 21:48:00 +0200 Subject: Add token login to bokfctl and enforce admin scope for tokens - bokfctl: --token / BOKFD_TOKEN via client_token_login - tokens must carry the admin scope for admin commands (was bypassed) - docs: token-based snapshot for restic backups --- src/protocol.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'src/protocol.c') diff --git a/src/protocol.c b/src/protocol.c index 7c00d6b..c528759 100644 --- a/src/protocol.c +++ b/src/protocol.c @@ -168,8 +168,7 @@ char *protocol_handle_line(sqlite3 *db, const char *line, size_t len) add_error(rdoc, resp, "FORBIDDEN", "owner role required", NULL); goto done; } - if (cmd->perm != PERM_ADMIN && scope && - !scope_has(r.sess->scopes, scope)) { + if (scope && !scope_has(r.sess->scopes, scope)) { add_error(rdoc, resp, "FORBIDDEN", "token scope does not allow this command", NULL); goto done; -- cgit v1.3