Authorize operation details by admin scope and isolate scoped clients

pigway_frame_flow/core/auth.py

@@ -46,6 +46,8 @@ def require(scope):
             account = session_user(request)
             if account:
                 request.state.client_id = "user:" + account["username"]
+                # Browser accounts currently administer this single-household service.
+                request.state.permissions = ALL_SCOPES
                 return request.state.client_id
             raise FlowError(E.UNAUTHORIZED, "Frame Flow API token required", 401)
         digest = hashlib.sha256(credentials.credentials.encode()).hexdigest()
@@ -57,6 +59,7 @@ def require(scope):
                         E.FORBIDDEN, "Token scope does not allow this action", 403
                     )
                 request.state.client_id = row["client_id"]
+                request.state.permissions = permissions
                 # Avoid writing last_used on every image or poll.
                 if not row["last_used_at"] or (
                     now_iso()[:16] != row["last_used_at"][:16]