i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-02 17:30:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

Allow full management tokens to access token management

Browse Source
This commit is contained in:
fawney19
2026-05-12 19:53:31 +08:00
parent 63149fe281
commit 38012c62ff
5 changed files with 166 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
apps/aether-gateway/src/handlers/admin/system/management_tokens.rs
View File

@@ -1,5 +1,7 @@
use crate::control::{
management_token_permission_catalog_payload, normalize_assignable_management_token_permissions,
management_token_permission_catalog_payload,
management_token_permissions_cover_all_assignable_permissions,
normalize_assignable_management_token_permissions,
};
use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
use crate::handlers::admin::shared::{query_param_optional_bool, query_param_value};
@@ -317,12 +319,20 @@ pub(crate) async fn maybe_build_local_admin_management_tokens_response(
return Ok(None);
}
if decision
let is_management_token = decision
.admin_principal
.as_ref()
.and_then(|principal| principal.management_token_id.as_deref())
.is_some()
{
.is_some();
let management_token_is_full = decision
.admin_principal
.as_ref()
.and_then(|principal| principal.management_token_permissions.as_deref())
.map_or(
true,
management_token_permissions_cover_all_assignable_permissions,
);
if is_management_token && !management_token_is_full {
return Ok(Some(
(
http::StatusCode::FORBIDDEN,