Merge branch 'main' into core/allow-token-for-other-user

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

authentik/core/api/tokens.py

@@ -2,6 +2,7 @@
 
 from typing import Any
 
+from django.http import HttpRequest
 from django.utils.timezone import now
 from drf_spectacular.utils import OpenApiResponse, extend_schema
 from rest_framework.decorators import action
@@ -46,6 +47,11 @@ class TokenSerializer(ManagedSerializer, ModelSerializer):
         if self.instance and self.instance.user_id:
             if user.pk != self.instance.user_id:
                 raise ValidationError("User cannot be changed")
+        request: HttpRequest = self.context.get("request")
+        if not request.user.has_perm("change_user", user) and not request.user.has_perm(
+            "authentik_core.change_user"
+        ):
+            raise ValidationError("Cannot create token for this user")
         return user
 
     def validate(self, attrs: dict[Any, str]) -> dict[Any, str]:
@@ -148,7 +154,6 @@ class TokenViewSet(UsedByMixin, ModelViewSet):
     def perform_create(self, serializer: TokenSerializer):
         if not self.request.user.is_superuser:
             instance = serializer.save(
-                user=self.request.user,
                 expiring=self.request.user.attributes.get(USER_ATTRIBUTE_TOKEN_EXPIRING, True),
             )
             self.request.user.assign_perms_to_managed_role(