Commit 10332149 authored by Your Name's avatar Your Name

Clean up token authorization middleware - remove token variable reference

The middleware logic is correct and matches requirements:
- Global tokens (aisbf.json): ONLY access global endpoints
- User tokens (database): ONLY access their own /api/u/<username> endpoints
- Database admin users: same as normal users (no special API access)
parent ca949768
......@@ -1353,8 +1353,7 @@ async def api_token_authorization_middleware(request: Request, call_next):
)
# Debug logging
token_short = token[:8] + "..." if len(token) > 8 else token
logger.info(f"Token auth check: token={token_short}, user_id={user_id}, authenticated_username={authenticated_user.get('username')}, target_username={target_username}")
logger.info(f"Token auth check: user_id={user_id}, authenticated_username={authenticated_user.get('username')}, target_username={target_username}")
if authenticated_user['username'] != target_username:
return JSONResponse(
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment