mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-26 13:39:47 +00:00
rcourtman
5fb27d4039
The organization-owner fix judged browser sessions only. API tokens on instance routes were still checked for scope alone, and the tenant middleware resolves an org-bound token to its own organization without the caller naming one. A token bound to a tenant organization and holding settings:write therefore reached system settings, SSO providers, token management, relay, log level, updates and the other instance surfaces. ensureAdminSession, behind RequireAdmin, and ensureSettingsScope now refuse a token unless it acts for the instance: not bound to any organization other than the default one, with OrgIDs taking precedence over OrgID. The route's scope still applies. The org variants (RequireOrgAdmin, ensureOrgAdminSession, ensureOrgSettingsWriteScope) keep judging tokens by scope alone. tokenHasInstanceWideAuthority is now the same binding rule plus full-access scope. The test notification broadcasts only to the request organization, so it moves to RequireOrgAdmin. Its tenant delivery test already relied on an org-bound token sending it, and that organization's managers may now send it from a session too. No path an organization manager can reach mints a settings scope: relay mobile, install, deploy and action-runner tokens carry relay, agent and report scopes only, and token management is instance administration. The API reference and the api-contracts, security-privacy, agent-lifecycle and storage-recovery contracts record the token rule.