fn general_api_token_allowed(method: &Method, path: &str, permission: &str) -> bool {
    let read = method == Method::GET
        && matches!(
            path,
            "/api/status"
                | "/api/system-info"
                | "/api/backends"
                | "/api/docker"
                | "/api/certificates"
                | "/api/acme"
                | "/api/traffic"
                | "/api/cache"
                | "/api/transform"
                | "/api/tunnels"
                | "/api/config"
                | "/api/config/history"
                | "/api/logs"
                | "/api/file-logs"
                | "/api/file-logs/query"
                | "/api/metrics"
                | "/api/metrics/json"
                | "/api/metrics/summary"
                | "/api/cache/bans"
        )
        || (method == Method::GET
            && path
                .strip_prefix("/api/config/")
                .is_some_and(|section| ConfigSection::from_name(section).is_some()));
    let write = permission == "rw"
        && ((method == Method::PUT
            && (path == "/api/config"
                || path
                    .strip_prefix("/api/config/")
                    .is_some_and(|section| ConfigSection::from_name(section).is_some())))
            || (method == Method::POST
                && matches!(
                    path,
                    "/api/config/reload"
                        | "/api/config/history/restore"
                        | "/api/cache/purge"
                        | "/api/cache/invalidate"
                        | "/api/config/geoip/update"
                        | "/api/docker/refresh"
                        | "/api/certificates/reload"
                ))
            || (method == Method::POST
                && path
                    .strip_prefix("/api/certificates/")
                    .and_then(|part| part.strip_suffix("/reload"))
                    .is_some_and(crate::config::valid_id)));
    read || write
}