Admin token is not strictly more than a curator token in terms of permissions #230

New issue

Open

opened 2026-06-25 07:44:30 +00:00 by mih · 1 comment

mih commented 2026-06-25 07:44:30 +00:00

Owner

Copy link

My assumption was that an admin has "all access", but this is not true. It appears that an admin token is just for the admin API.

My assumption was that an admin has "all access", but this is not true. It appears that an admin token is just for the admin API.

cmo commented 2026-07-24 13:45:26 +00:00

Owner

Copy link

Yes, admin tokens are completely separated from all "data-handling" tokens. The main motive for this decision was simpler, more robust security validation. To ensure control over admin access, admin tokens are never authorized via external sources, only via the API and the persisted configuration (and via the command line option --admin-token-hash).

If the same token should be used for curation and administration, a curator token could be added as admin token as well, thus supporting data-handling as well as reconfiguration.

Yes, admin tokens are completely separated from all "data-handling" tokens. The main motive for this decision was simpler, more robust security validation. To ensure control over admin access, admin tokens are never authorized via external sources, only via the API and the persisted configuration (and via the command line option --`admin-token-hash`). If the same token should be used for curation and administration, a curator token could be added as admin token as well, thus supporting data-handling as well as reconfiguration.

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

master

better-put

pass-code-check

packaging

improve-load-config

remove_duplication

audit-with-apply-change-set

forgejo-labels

maintenance-command

move-workflow-to-forgejo

classes-in-server-endpoint

redirect-root

linkml-test

issue-175

fix_any_of

forgejo-authsource-caching

issue-168

graphql

6.3.7

6.3.6

6.3.5

6.3.4

6.3.3

6.3.2

6.3.1

6.3.0

6.2.2

6.2.1

6.2.0

6.1.0

6.0.2

6.0.1

6.0.0

5.6.1

5.6.0

5.5.0

5.4.0

5.3.6

5.3.5

5.3.4

5.3.3

5.3.2

5.3.1

5.3.0

5.2.1

5.2.0

5.1.1

5.1.0

5.0.3

5.0.2

5.0.1

5.0.0

4.7.0

4.6.1

4.6.0

4.5.3

4.5.2

4.5.1

4.5.0

4.4.0

4.3.1

4.2.0

4.3.0

4.1.1

4.1.0

4.0.0

3.6.0

3.5.0

3.3.3

3.3.2

3.3.1

3.3.0

3.2.1

3.1.0

3.0.1

3.0.0

2.4.1

2.3.4

2.3.3

2.4.0

2.3.2

2.3.0

2.2.0

2.1.0

2.0.1

2.0.0

1.1.0

1.0.0

0.5.0

0.4.0

0.3.0

0.2.7

0.2.6

0.2.5

0.2.4

0.2.3

0.2.2

0.2.1

0.2.0

0.1.1

0.1.0

labelless

Labels

Clear labels   

bug

Something isn't working

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

question

Further information is requested

  

wontfix

This will not be worked on

No labels

bug

documentation

duplicate

enhancement

good first issue

help wanted

invalid

question

wontfix

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

orinoco/dump-things-service#230

No description provided.