mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-07-16 14:52:35 -05:00
9e880e98a5
The api-token permission group key is derived from the route slug. Every group is snake_case except "time-entries", whose URL slug carries a hyphen. The frontend snake_cases request payloads, rewriting that group key to "time_entries", which the backend then rejected — so a token granted the Time Entries scope could not be saved. Canonicalise group and path-segment names to snake_case where they are derived, and normalise the group key on token validation and authorisation so any token stored under the old hyphenated key keeps resolving. No data migration is needed: the v2 time-entries resource has never shipped in a release.