From 071b7e9b01e41d4048b1bbb3d9caaac4c8a526de Mon Sep 17 00:00:00 2001
From: Anders Betts <anders.betts@gmail.com>
Date: Thu, 17 Sep 2026 21:48:00 +0200
Subject: Add token login to bokfctl and enforce admin scope for tokens

- bokfctl: --token / BOKFD_TOKEN via client_token_login
- tokens must carry the admin scope for admin commands (was bypassed)
- docs: token-based snapshot for restic backups
---
 tests/test_core.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

(limited to 'tests')

diff --git a/tests/test_core.c b/tests/test_core.c
index b2c828d..5960665 100644
--- a/tests/test_core.c
+++ b/tests/test_core.c
@@ -540,6 +540,12 @@ int main(void)
     CHECK(db_exec(g_db, "DELETE FROM audit_log", &err) != 0);
     free(err);
 
+    d = call(reqf("{\"v\":1,\"id\":\"27\",\"cmd\":\"backup.snapshot\","
+                  "\"session\":\"%s\"}",
+                  ro_session));
+    CHECK_STR(d, "error.code", "FORBIDDEN");
+    yyjson_doc_free(d);
+
     d = call(reqf("{\"v\":1,\"id\":\"28\",\"cmd\":\"backup.snapshot\","
                   "\"session\":\"%s\"}",
                   g_session));
@@ -548,6 +554,30 @@ int main(void)
     CHECK(jstr(d, "result.sha256") && strlen(jstr(d, "result.sha256")) == 64);
     yyjson_doc_free(d);
 
+    d = call(reqf("{\"v\":1,\"id\":\"28b\",\"cmd\":\"token.create\","
+                  "\"session\":\"%s\",\"org\":%d,\"args\":"
+                  "{\"label\":\"backup\",\"scopes\":[\"admin\"]}}",
+                  g_session, (int)org_id));
+    CHECK_OK(d);
+    char backup_token[128] = "";
+    snprintf(backup_token, sizeof backup_token, "%s", jstr(d, "result.token"));
+    yyjson_doc_free(d);
+
+    d = call(reqf("{\"v\":1,\"id\":\"28c\",\"cmd\":\"session.open\",\"args\":"
+                  "{\"method\":\"token\",\"token\":\"%s\"}}",
+                  backup_token));
+    CHECK_OK(d);
+    char backup_session[128] = "";
+    snprintf(backup_session, sizeof backup_session, "%s",
+             jstr(d, "result.session"));
+    yyjson_doc_free(d);
+
+    d = call(reqf("{\"v\":1,\"id\":\"28d\",\"cmd\":\"backup.snapshot\","
+                  "\"session\":\"%s\",\"args\":{\"dest\":\"%s/snap-token.db\"}}",
+                  backup_session, tmpdir));
+    CHECK_OK(d);
+    yyjson_doc_free(d);
+
     d = call(reqf("{\"v\":1,\"id\":\"29\",\"cmd\":\"describe\","
                   "\"session\":\"%s\"}",
                   g_session));
-- 
cgit v1.3