From 7b9390be50e7c22abe41c32bda20927cdf376e88 Mon Sep 17 00:00:00 2001
From: Dave Horton <daveh@beachdognet.com>
Date: Mon, 28 Jun 2021 13:00:35 -0400
Subject: [PATCH] bugfix: prevent an account level api key from creating an
 admin-level api key

---
 lib/routes/api/api-keys.js | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/lib/routes/api/api-keys.js b/lib/routes/api/api-keys.js
index 209654d..f424b67 100644
--- a/lib/routes/api/api-keys.js
+++ b/lib/routes/api/api-keys.js
@@ -71,10 +71,7 @@ async function validateDeleteToken(req, sid) {
 router.post('/', async(req, res) => {
   const logger = req.app.locals.logger;
   try {
-    if ('add' in preconditions) {
-      assert(typeof preconditions.add === 'function');
-      await preconditions.add(req);
-    }
+    await validateAddToken(req);
     const uuid = await ApiKey.make(req.body);
     res.status(201).json({sid: uuid, token: req.body.token});
   } catch (err) {