Method RevokeMagicAuthToken

admin/server/magic_tokens.go:227–258

(ctx context.Context, req *adminv1.RevokeMagicAuthTokenRequest)

}

func (s *Server) RevokeMagicAuthToken(ctx context.Context, req *adminv1.RevokeMagicAuthTokenRequest) (*adminv1.RevokeMagicAuthTokenResponse, error) {
	observability.AddRequestAttributes(ctx,
		attribute.String("args.token_id", req.TokenId),
	)

	tkn, err := s.admin.DB.FindMagicAuthToken(ctx, req.TokenId, false)
	if err != nil {
		return nil, err
	}

	proj, err := s.admin.DB.FindProject(ctx, tkn.ProjectID)
	if err != nil {
		return nil, err
	}

	claims := auth.GetClaims(ctx)
	projPerms := claims.ProjectPermissions(ctx, proj.OrganizationID, proj.ID)
	if !projPerms.ManageMagicAuthTokens {
		// If they don't have manage permissions, they can only revoke tokens they created themselves.
		isCreator := tkn.CreatedByUserID != nil && *tkn.CreatedByUserID == claims.OwnerID()
		if !projPerms.CreateMagicAuthTokens || !isCreator {
			return nil, status.Error(codes.PermissionDenied, "not allowed to revoke this magic auth token")
		}
	}

	err = s.admin.DB.DeleteMagicAuthToken(ctx, tkn.ID)
	if err != nil {
		return nil, err
	}

	return &adminv1.RevokeMagicAuthTokenResponse{}, nil
}

func (s *Server) magicAuthTokensToPB(tkns []*database.MagicAuthTokenWithUser, org *database.Organization, proj *database.Project) ([]*adminv1.MagicAuthToken, error) {
	var pbs []*adminv1.MagicAuthToken