Mechanism to prevent tokens creating tokens, closes #1857

datasette/default_permissions.py

@@ -69,4 +69,4 @@ def actor_from_request(datasette, request):
     if expires_at is not None:
         if expires_at < time.time():
             return None
-    return {"id": decoded["a"], "dstok": True}
+    return {"id": decoded["a"], "token": "dstok"}

datasette/views/special.py

@@ -177,6 +177,10 @@ class CreateTokenView(BaseView):
             raise Forbidden(
                 "You must be logged in as an actor with an ID to create a token"
             )
+        if request.actor.get("token"):
+            raise Forbidden(
+                "Token authentication cannot be used to create additional tokens"
+            )
 
     async def get(self, request):
         self.check_permission(request)