Merge pull request #3655 from moverq1337/fix/access-token-delete-root-key

Fix access token deletion for root API keys
2026-09-01 08:51:35 +02:00 · 2026-08-31 16:54:18 -04:00
parent 0dece5fef1 1650ece0c3
commit 8dfc95347f
1 changed files with 5 additions and 0 deletions
@@ -68,6 +68,11 @@ export async function verifyApiKeyAccessTokenAccess(
            );
        }

+        if (apiKey.isRoot) {
+            // Root keys can access any access token in any org
+            return next();
+        }
+
        if (!resource.orgId) {
            return next(
                createHttpError(