Skip to content

Conversation

@Piskoo
Copy link
Collaborator

@Piskoo Piskoo commented Jan 13, 2026

Summary

This PR adds support for instance admin tokens to existing api token logic

Changes

  • Organization in api tokens is now optional
  • Adds an explicit JWT scope claim for instance admin API tokens to enable clearer identification
  • Add permissions(policies) planned for instance admin token
  • Adds correct handling for instance admin tokens to api token middleware

Signed-off-by: Sylwester Piskozub <[email protected]>
Signed-off-by: Sylwester Piskozub <[email protected]>
Signed-off-by: Sylwester Piskozub <[email protected]>
Signed-off-by: Sylwester Piskozub <[email protected]>
Signed-off-by: Sylwester Piskozub <[email protected]>
Signed-off-by: Sylwester Piskozub <[email protected]>
@Piskoo Piskoo changed the title feat(api-token): add instance token support feat(api-token): add instance admin token support Jan 13, 2026
@Piskoo Piskoo changed the title feat(api-token): add instance admin token support feat(api-token): add instance admin token Jan 13, 2026
@Piskoo Piskoo marked this pull request as ready for review January 13, 2026 14:05
@Piskoo Piskoo requested review from jiparis and migmartri January 13, 2026 14:05
ALTER TABLE "api_tokens" ALTER COLUMN "organization_id" DROP NOT NULL;

-- Create index "apitoken_name" to table: "api_tokens"
CREATE UNIQUE INDEX "apitoken_name" ON "api_tokens" ("name") WHERE ((revoked_at IS NULL) AND (organization_id IS NULL));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this mean that now you can have an API token with the same name in the same org?

Copy link
Collaborator Author

@Piskoo Piskoo Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, you can have an instance admin API token with the same name if the other one with the same name was revoked, the same way as org API tokens in here

index.Fields("name").Edges("organization").Unique().Annotations(
entsql.IndexWhere("revoked_at IS NULL AND project_id IS NULL"),

Signed-off-by: Sylwester Piskozub <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants