fix(api): properly validate auth/tokens/<uuid:token_id>/

api/desecapi/permissions.py

@@ -76,7 +76,7 @@ class AuthTokenCorrespondsToViewToken(permissions.BasePermission):
     """
 
     def has_permission(self, request, view):
-        return view.kwargs['token_id'] == str(request.auth.pk)
+        return view.kwargs['token_id'] == request.auth.pk
 
 
 class IsVPNClient(permissions.BasePermission):

api/desecapi/urls/version_1.py

@@ -21,8 +21,8 @@ auth_urls = [
 
     # Token management
     path('tokens/', include(tokens_router.urls)),
-    path('tokens/<token_id>/policies/', views.TokenPoliciesRoot.as_view(), name='token-policies-root'),
-    path('tokens/<token_id>/policies/domain/', include(tokendomainpolicies_router.urls)),
+    path('tokens/<uuid:token_id>/policies/', views.TokenPoliciesRoot.as_view(), name='token-policies-root'),
+    path('tokens/<uuid:token_id>/policies/domain/', include(tokendomainpolicies_router.urls)),
 ]
 
 domains_router = SimpleRouter()