Allow specifying multiple permissions.

2025-08-31 04:47:38 +00:00
parent c67a83abdc
commit c06b7ddf26
3 changed files with 12 additions and 11 deletions
@@ -44,12 +44,12 @@ def register_api_routes(app: FastAPI):

    @app.post("/auth/validate")
    async def validate_token(
-        response: Response, perm: str | None = None, auth=Cookie(None)
+        response: Response, perm: list[str] | None = None, auth=Cookie(None)
    ):
        """Lightweight token validation endpoint.

        Query Params:
-        - perm: optional permission ID the caller must possess
+        - perm: repeated permission IDs the caller must possess (ALL required)
        """

        s = await authz.verify(auth, perm)