xarmian d2ee26cccd fix(auth): platform administration refuses an API token (BUG-3361) ...

BREAKING for anyone driving /api/v1/admin/* or admin account creation with
a personal access token: those now answer 403 session_required. Use a
`pad auth login` CLI session, or on self-host set PAD_ADMIN_API_TOKENS=allow.

An admin's PAT carried full platform authority. codex reproduced the chain
during BUG-3336's review: register an account with a chosen password,
promote it to admin, sign in as it, and reset any account's password. A
leaked admin token therefore escalated to interactive sessions for any
account.

- refuseAPITokenForAdmin guards the whole /api/v1/admin route group, so an
  admin route added later is refused by construction.
  TestBUG3361_EveryAdminRouteRefusesAnAdminPAT walks the router to hold it.
- handleRegister refuses admin-create signup with an API token.
- PAD_ADMIN_API_TOKENS=allow is the self-host escape hatch. It is read at
  startup, logs a WARN, and is never honoured in cloud mode. Documented in
  docs/deployment.md, Security.
- A browser session and a CLI session (padsess_) are unaffected. So is the
  Pad Cloud sidecar, which authenticates with the cloud secret, never a
  PAT. /audit-log already refused a PAT (BUG-3334).

Claude-Session: https://claude.ai/code/session_01H63zaWhkb5pAafx2WGjrVC

2026-10-02 21:50:05 +00:00

..

screenshots

test(screenshots): capture in dark mode (Pad's default theme) (#319)

2026-04-30 13:10:51 -04:00

architecture.md

ci(web): decide the npm audit gate from the report, not the exit code, and run it last (BUG-2881) (#1247)

2026-09-04 10:45:21 -04:00

backup.md

feat(materialize): recover unsaved editor sessions into items.content (TASK-2198 U4) (#1683)

2026-09-30 11:03:07 -04:00

brand.md

fix(brand): name the entity as Perpetual Software LLC everywhere (TASK-3321) (#1722)

2026-10-02 08:22:41 -04:00

deployment.md

fix(auth): platform administration refuses an API token (BUG-3361)

2026-10-02 21:50:05 +00:00