Fix root API key access in verifyApiKeyAccessTokenAccess

2026-09-01 16:59:22 +02:00 · 2026-08-28 22:45:31 +03:00
parent 49dcc590ce
commit 1650ece0c3
1 changed files with 5 additions and 0 deletions
@@ -68,6 +68,11 @@ export async function verifyApiKeyAccessTokenAccess(
            );
        }

+        if (apiKey.isRoot) {
+            // Root keys can access any access token in any org
+            return next();
+        }
+
        if (!resource.orgId) {
            return next(
                createHttpError(