Remove the notification menu from the VM and LXC backup dialog; backups follow the notification settings

AppImage/scripts/jwt_middleware.py

@@ -8,6 +8,8 @@ from flask import request, jsonify, g
 from functools import wraps
 from auth_manager import load_auth_config, verify_token, verify_token_full
 
+_READ_METHODS = ('GET', 'HEAD', 'OPTIONS')
+
 
 def require_auth(f):
     """
@@ -64,12 +66,18 @@ def require_auth(f):
         token = parts[1]
         
         # Verify token
-        username = verify_token(token)
+        username, scope = verify_token_full(token)
         if not username:
             return jsonify({
                 "error": "Invalid or expired token",
                 "message": "Please log in again"
             }), 401
+
+        # read_only tokens may only read; any method that can change
+        # state needs full_admin.
+        if request.method not in _READ_METHODS and scope != 'full_admin':
+            return jsonify({"error": "Insufficient scope",
+                            "message": f"This action requires a full_admin token (your token: {scope})"}), 403
         
         # Token is valid, allow access
         return f(*args, **kwargs)