Authorize operation details by admin scope and isolate scoped clients

pigway_frame_flow/api/app.py

@@ -815,11 +815,12 @@ def create_app(settings=None, start_worker=True):
         tags=["Operations"],
         dependencies=[Depends(require("history:read"))],
     )
-    def operations(limit: int = Query(default=50, ge=1, le=200)):
+    def operations(request: Request, limit: int = Query(default=50, ge=1, le=200)):
         return [
             service.operation(x["id"])
             for x in db.all(
-                "SELECT id FROM operations ORDER BY created_at DESC LIMIT ?", (limit,)
+                "SELECT id FROM operations WHERE (? OR client_id=?) ORDER BY created_at DESC LIMIT ?",
+                ("admin" in request.state.permissions, request.state.client_id, limit),
             )
         ]
 
@@ -831,7 +832,10 @@ def create_app(settings=None, start_worker=True):
     )
     def operation(operation_id: str, request: Request):
         op = service.operation(operation_id)
-        if request.state.client_id not in ("admin", op["client_id"]):
+        if (
+            "admin" not in request.state.permissions
+            and request.state.client_id != op["client_id"]
+        ):
             raise FlowError(E.FORBIDDEN, "Operation belongs to another client", 403)
         return op
 

pigway_frame_flow/core/auth.py

@@ -46,6 +46,8 @@ def require(scope):
             account = session_user(request)
             if account:
                 request.state.client_id = "user:" + account["username"]
+                # Browser accounts currently administer this single-household service.
+                request.state.permissions = ALL_SCOPES
                 return request.state.client_id
             raise FlowError(E.UNAUTHORIZED, "Frame Flow API token required", 401)
         digest = hashlib.sha256(credentials.credentials.encode()).hexdigest()
@@ -57,6 +59,7 @@ def require(scope):
                         E.FORBIDDEN, "Token scope does not allow this action", 403
                     )
                 request.state.client_id = row["client_id"]
+                request.state.permissions = permissions
                 # Avoid writing last_used on every image or poll.
                 if not row["last_used_at"] or (
                     now_iso()[:16] != row["last_used_at"][:16]