From: Michael Tremer <michael.tremer@ipfire.org>
Date: Mon, 2 Mar 2026 17:55:30 +0000 (+0000)
Subject: api: auth: The impersonation is tied to the key and not the user
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=778d1a2b8945627a58a94392edd74833dbc9d509;p=dbl.git

api: auth: The impersonation is tied to the key and not the user

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/dbl/api/__init__.py b/src/dbl/api/__init__.py
index 80d4799..81596c5 100644
--- a/src/dbl/api/__init__.py
+++ b/src/dbl/api/__init__.py
@@ -74,7 +74,7 @@ async def require_api_key(request: fastapi.Request, api_key: str = fastapi.Depen
 		log.debug("%s wants to impersonate '%s'" % (user.uid, impersonated_uid))
 
 		# Check if we have permissions to perform this action
-		if not user.can_impersonate:
+		if not key.can_impersonate:
 			raise fastapi.HTTPException(403, "Impersonation denied")
 
 		# Fetch the impersonated user