From a0c8fcb2693cc017d78e39a6e623d1c53e493a84 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 22:23:52 +0000 Subject: access: a token with a limit changes no credentials A token's limit narrows every endpoint but those under /auth, which any registered user may call. Among them, PUT and DELETE /auth/keys/{id} change the keys the user logs in with, and POST /auth/logout ends every token of the user. With the token a dashboard hands to another member's (the member list, read, five minutes), its holder could add a key of its own and log in by it as the user, with everything the user may do. These now take a password or a token without a limit (Need::Credentials, refused where Caps::limited). A narrowed token still refreshes within its limit, says who it is, lists the user's keys and ends its own session (DELETE /auth/session): a dashboard opened from another member's logs out with it. --- src/access/mod.rs | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'src/access') diff --git a/src/access/mod.rs b/src/access/mod.rs index e04be02..ad50c72 100644 --- a/src/access/mod.rs +++ b/src/access/mod.rs @@ -192,6 +192,11 @@ impl Caps { .is_none_or(|limit| limit.iter().any(|cap| cap.reaches(right, path))) } + /// Whether a token's limit narrows them (`within`). + pub(crate) fn limited(&self) -> bool { + self.limit.is_some() + } + pub(crate) fn is_empty(&self) -> bool { self.caps.is_empty() || self.limit.as_ref().is_some_and(Vec::is_empty) } -- cgit v1.3.1