refactor: tighten read-only access token scope enforcement

2026-05-20 13:38:33 +05:30
parent d2de7bed6c
commit fe944720a8
2 changed files with 23 additions and 3 deletions
@@ -1,4 +1,7 @@
-json.access_token resource.access_token&.token
+# Withhold the full-scope token from callers who authenticated with a
+# read-only token — otherwise GET /api/v1/profile would let a read-only
+# holder lift the full token and bypass the scope gate entirely.
+json.access_token resource.access_token&.token unless @access_token&.scope == 'read_only'
 json.read_only_access_token resource.read_only_access_token&.token
 json.account_id resource.active_account_user&.account_id
 json.available_name resource.available_name