v.34.1

src/admin/api_token_access.rs

@@ -0,0 +1,48 @@
+// Narrow method/path allowlist: tokens never inherit browser-only administration
+// routes (password/session, credentials, backups, docs, preferences or SSE).
+fn general_api_token_allowed(method: &Method, path: &str, permission: &str) -> bool {
+    let read = method == Method::GET
+        && matches!(
+            path,
+            "/api/status"
+                | "/api/system-info"
+                | "/api/backends"
+                | "/api/docker"
+                | "/api/certificates"
+                | "/api/acme"
+                | "/api/traffic"
+                | "/api/cache"
+                | "/api/transform"
+                | "/api/tunnels"
+                | "/api/config"
+                | "/api/config/history"
+                | "/api/logs"
+                | "/api/file-logs"
+                | "/api/file-logs/query"
+                | "/api/metrics"
+                | "/api/cache/bans"
+        );
+    let write = permission == "rw"
+        && ((method == Method::PUT
+            && (path == "/api/config"
+                || path.strip_prefix("/api/config/").is_some_and(|part| {
+                    !part.is_empty() && part != "history" && part != "reload" && !part.contains('/')
+                })))
+            || (method == Method::POST
+                && matches!(
+                    path,
+                    "/api/config/reload"
+                        | "/api/config/history/restore"
+                        | "/api/cache/purge"
+                        | "/api/cache/invalidate"
+                        | "/api/geoip/update"
+                        | "/api/docker/refresh"
+                        | "/api/certificates/reload"
+                ))
+            || (method == Method::POST
+                && path
+                    .strip_prefix("/api/certificates/")
+                    .and_then(|part| part.strip_suffix("/reload"))
+                    .is_some_and(crate::config::valid_id)));
+    read || write
+}