mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-05 00:18:00 +00:00
ce4b91e90f
Partial-auth (mfa_pending) and enroll-only (pilot_enroll) tokens skipped the admin check on /ws because any set scope was treated as already gated. Reject those scopes in the shared upgrade pipeline, and deny unknown scopes on the generic path while allowing api_token, console_session, and pilot_tunnel.