fix test expectation

management/server/http/middleware/auth_middleware.go

@@ -142,6 +142,12 @@ func (m *AuthMiddleware) checkPATFromRequest(r *http.Request, auth []string) (*h
 		return r, fmt.Errorf("token expired")
 	}
 
+	if impersonate, ok := r.URL.Query()["account"]; ok && len(impersonate) == 1 {
+		if user.AccountID != impersonate[0] {
+			return r, fmt.Errorf("token is not valid for this account")
+		}
+	}
+
 	err = m.authManager.MarkPATUsed(ctx, pat.ID)
 	if err != nil {
 		return r, err

management/server/http/middleware/auth_middleware_test.go

@@ -239,16 +239,9 @@ func TestAuthMiddleware_Handler_Child(t *testing.T) {
 			},
 		},
 		{
-			name:       "Valid PAT Token ignores child",
+			name:       "Valid PAT Token returns forbidden for child",
 			path:       "/test?account=xyz",
 			authHeader: "Token " + PAT,
-			expectedUserAuth: &nbcontext.UserAuth{
-				AccountId:      accountID,
-				UserId:         userID,
-				Domain:         testAccount.Domain,
-				DomainCategory: testAccount.DomainCategory,
-				IsPAT:          true,
-			},
 		},
 		{
 			name:       "Valid JWT Token",

management/server/user.go

@@ -805,7 +805,7 @@ func (am *DefaultAccountManager) GetUsersFromAccount(ctx context.Context, accoun
 		return nil, err
 	}
 
-	if err := am.permissionsManager.ValidateAccountAccess(ctx, accountID, initiatorUser, false); err != nil {
+	if err := am.permissionsManager.ValidateAccountAccess(ctx, accountID, initiatorUser, true); err != nil {
 		return nil, err
 	}