INNER CODE UNIT · Python

service_token

skyportal/skyportal · services/assistant/app.py:355

def service_token(session, user_id):
    """A short-lived token carrying the user's own access.

    An admin sees things through an ACL rather than through group membership, so
    a token without their ACLs would leave the assistant insisting a filter they
    are looking at does not exist. Writing is refused in `call_tool` instead.
    """
    user = session.scalar(sa.select(User).where(User.id == user_id))
    token = Token(
        created_by_id=user_id, name=f"{SERVICE_TOKEN_PREFIX}{uuid.uuid4().hex}"
    )
    # permissions, not acls: most of a user's ACLs reach them through a role.
    token.acls = session.scalars(
        sa.select(ACL).where(ACL.id.in_(user.permissions))
    ).all()
    session.add(token)
    session.commit()
    return token

View source record →