mirror of
https://github.com/hanzoai/base.git
synced 2026-11-02 20:08:14 +00:00
zeekayandHanzo Dev
007a8c8002
A migration replaces the _superusers token secrets once, so every superuser token a Base signed itself stops verifying on the first start. auth-refresh answers 403 for a superuser token that names no IAM subject, and answers an IAM token as before. The test data records the rotation as applied, so its tokens stand for tokens signed after it. Co-authored-by: Hanzo Dev <[email protected]>
19 lines
476 B
Go
19 lines
476 B
Go
package migrations
|
|
|
|
import "github.com/hanzoai/base/core"
|
|
|
|
// Superuser tokens come from IAM. Replacing the secrets a Base signs superuser
|
|
// tokens with ends every superuser token a Base signed itself.
|
|
func init() {
|
|
core.SystemMigrations.Register(func(txApp core.App) error {
|
|
superusers, err := txApp.FindCollectionByNameOrId(core.CollectionNameSuperusers)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
superusers.RotateTokenSecrets()
|
|
|
|
return txApp.Save(superusers)
|
|
}, nil)
|
|
}
|