diff options
Diffstat (limited to 'src/access/rules.rs')
| -rw-r--r-- | src/access/rules.rs | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/access/rules.rs b/src/access/rules.rs index d120961..5c839af 100644 --- a/src/access/rules.rs +++ b/src/access/rules.rs @@ -269,7 +269,9 @@ pub(crate) fn judge_reading( (Some(meta::LOCAL), _) => false, // Logging out: a user revokes its own tokens (`POST /auth/logout`); one who // manages users, anyone's (`DELETE /admin/users/{name}/tokens`). - (Some(meta::LOGOUTS), Some(owner)) => { + // Ending a session: a user its own (`DELETE /auth/session`); one who manages + // users, anyone's. + (Some(meta::LOGOUTS | meta::SESSIONS), Some(owner)) => { change.user == Some(owner) || user_may(path) || user_may(&meta::path(&[meta::USERS])) |