From b64fe72a448dff1a5d70c4f4e5b5b7ef8c23b648 Mon Sep 17 00:00:00 2001
From: Christian Monch <christian.moench@web.de>
Date: Fri, 31 Jul 2026 13:50:10 +0200
Subject: [PATCH] feat: add admin_token_hash attribute to dumpthings spec

This commit adds the attribute `admin_token_hash` to
the `dumpthings` specification. The attribute is optional.
If provided it should be a valid token-hash, currently
this is a hex-encoded sha256 hash (64 digits) of the plain
text admin token.

For security reasons, there is currently no support to store
plain text admin tokens in the configuration.
---
 liab_deployments/deploy/dumpthings.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/liab_deployments/deploy/dumpthings.py b/liab_deployments/deploy/dumpthings.py
index 3f71575..6d91b2a 100644
--- a/liab_deployments/deploy/dumpthings.py
+++ b/liab_deployments/deploy/dumpthings.py
@@ -33,6 +33,7 @@ ExecStart=bash -c "PATH={user_home}/.local/bin:$PATH; \\
       --port {host_port} \\
       --config {config_filename} \\
       --root-path /api \\
+      {admin_token_hash_args} \\
       {service_args} \\
       {user_home}/{data_dir} \\
     "
@@ -89,6 +90,7 @@ def deploy_sites():
                 'systemd_service_params',
                 'python_version',
                 'dumpthings_version',
+                'admin_token_hash',
             )
         }
         _deploy_site(
@@ -120,6 +122,7 @@ def _deploy_site(
     dumpthings_version: str | None = None,
     python_version: str | None = None,
     staticsite_root_dir: str | None = None,
+    admin_token_hash: str | None = None,
 ):
     user_name, uid = user_spec
     user_home = f'/home/{user_name}'
@@ -164,6 +167,11 @@ def _deploy_site(
             service_args=service_args or '',
             config_filename=config_file,
             data_dir=data_dir,
+            admin_token_hash_args=(
+                f'--admin-token-hash {admin_token_hash}'
+                if admin_token_hash
+                else ''
+            ),
         ),
     )
 
-- 
2.52.0