In Invenio, access tokens are bound to a specific user, meaning that the token will have the same rights as the user. Creating an access token for a user with librarian access rights will grant not only read permissions, but also update/delete permissions.
To avoid this, we want to disable the possibility of creating access tokens.
In Invenio, access tokens are bound to a specific user, meaning that the token will have the same rights as the user. Creating an access token for a user with
librarianaccess rights will grant not only read permissions, but also update/delete permissions.To avoid this, we want to disable the possibility of creating access tokens.