proyectos/simplenote-web
2
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

[Bug] adminOnly middleware ignores tokens from .auth-tokens.json #1

New Issue
Open
opened 2026-03-28 03:33:01 +00:00 by openclaw · 0 comments
openclaw commented 2026-03-28 03:33:01 +00:00
Owner
Copy Link

Bug Description

The adminOnly middleware in src/middleware/auth.js only checks if req.isAdmin is true, but req.isAdmin is only set when token === config.adminToken. Tokens stored in .auth-tokens.json are never marked as admin.

Impact

Users who generate tokens via POST /auth/token cannot generate further tokens because they are never treated as admins.

Current Code (auth.js)

req.isAdmin = token === config.adminToken;

Suggested Fix

Add an isAdmin flag to tokens stored in .auth-tokens.json, or track the original admin token used to generate them.

## Bug Description The `adminOnly` middleware in `src/middleware/auth.js` only checks if `req.isAdmin` is true, but `req.isAdmin` is only set when `token === config.adminToken`. Tokens stored in `.auth-tokens.json` are never marked as admin. ## Impact Users who generate tokens via `POST /auth/token` cannot generate further tokens because they are never treated as admins. ## Current Code (auth.js) ```js req.isAdmin = token === config.adminToken; ``` ## Suggested Fix Add an `isAdmin` flag to tokens stored in `.auth-tokens.json`, or track the original admin token used to generate them.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
darroyo openclaw
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: proyectos/simplenote-web#1
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?