Vantage/vantage-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: carry the token tag restriction on the session

Browse Source
This commit is contained in:
mrhid6
2026-09-08 13:37:05 +00:00
parent f9df426e6c
commit 2481974b3a
3 changed files with 37 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/internal/api/tokens.go
+17 -5
View File
@@ -74,8 +74,9 @@ func createToken(c *gin.Context) {
var body struct {
Name string `json:"name" binding:"required"`
Role string `json:"role" binding:"required"`
Scopes []string `json:"scopes" binding:"required"`
ExpiresInDays *int `json:"expires_in_days"`
Scopes []string `json:"scopes" binding:"required"`
ExpiresInDays *int `json:"expires_in_days"`
TagSelector map[string]string `json:"tag_selector"`
}
if err := c.ShouldBindJSON(&body); err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
@@ -108,9 +109,16 @@ func createToken(c *gin.Context) {
}
}
if !services.SelectorNarrowerOrEqual(body.TagSelector, auth.ServerScope(c)) {
c.JSON(http.StatusForbidden, gin.H{
"error": "a token cannot reach servers its creator cannot reach",
})
return
}
tok, plaintext, err := services.CreateAPIToken(
auth.InstanceID(c), auth.UserID(c),
body.Name, body.Role, body.Scopes, nil, body.ExpiresInDays, c.ClientIP(),
body.Name, body.Role, body.Scopes, body.TagSelector, body.ExpiresInDays, c.ClientIP(),
)
switch {
case errors.Is(err, services.ErrTokenNameTaken):
@@ -137,8 +145,12 @@ func createToken(c *gin.Context) {
if tok.ExpiresAt != nil {
expiry = "expires " + tok.ExpiresAt.Format("2006-01-02")
}
services.LogEvent(auth.InstanceID(c), "token.created", actorFromCtx(c), "", "",
fmt.Sprintf("API token '%s' created with role %s, scopes %v, %s", tok.Name, tok.Role, tok.Scopes, expiry))
detail := fmt.Sprintf("API token '%s' created with role %s, scopes %v, %s",
tok.Name, tok.Role, tok.Scopes, expiry)
if len(tok.TagSelector) > 0 {
detail += fmt.Sprintf(", restricted to %v", tok.TagSelector)
}
services.LogEvent(auth.InstanceID(c), "token.created", actorFromCtx(c), "", "", detail)
// The plaintext is returned exactly once and is not stored anywhere.
c.JSON(http.StatusCreated, CreateTokenResponse{Token: plaintext, Record: *tok})