fix: check self-service flag in token middleware

application-research · May 25, 2023 · a561b72 · a561b72
1 parent d2ec999
commit a561b72
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/api/selfservice.go b/api/selfservice.go
@@ -46,6 +46,9 @@ func selfServiceTokenMiddleware(dldm *core.DeltaDM) echo.MiddlewareFunc {
 			if p.ActorID == "" {
 				return c.String(401, "invalid provider self-service token")
 			}
+			if !p.AllowSelfService {
+				return c.String(401, "provider is not allowed to self-serve, please contact administrator to enable it")
+			}
 
 			c.Set(PROVIDER, p)