@@ -61,25 +61,61 @@ def _hash(token: str) -> str:
     return hashlib.sha256((token or "").encode()).hexdigest()
 
 
+def allowed_scopes(owner, scopes) -> list:
+    """The scopes asked for, checked against the person the token belongs to.
+
+    Raises ValueError with a sentence to show.  Always the owner's role, never
+    the role of whoever is editing: an administrator giving a developer's
+    token the approve scope would hand that developer an administrator's power
+    through the back door.
+    """
+    from app.core import rbac
+
+    wanted = sorted({s.strip() for s in scopes if s.strip() in SCOPES})
+    if "external" in wanted and not rbac.can(owner, "external.manage"):
+        raise ValueError("Only an administrator's token can work with external sites.")
+    if "approve" in wanted and not (rbac.can(owner, "waiver.approve")
+                                    and rbac.can(owner, "exclusion.write")):
+        raise ValueError("Only an administrator's token can approve exceptions.")
+    if not wanted:
+        raise ValueError("Pick at least one thing it may do.")
+    return wanted
+
+
+def set_scopes(session, token_id: int, scopes, actor):
+    """Change what a live token may do.  -> (row, the scopes it had before).
+
+    Administrators only, on anybody's token.  The token itself does not
+    change, so nothing using it has to be updated: the next call is checked
+    against the new list.  Raises LookupError for a token that is not there,
+    or is revoked or expired, and ValueError for scopes its owner may not have.
+    """
+    from app.core.models import User
+
+    if actor is None or not _sees_everything(actor):
+        raise PermissionError("Only an administrator can change a token's scopes.")
+    row = session.query(ApiToken).filter(ApiToken.id == token_id).one_or_none()
+    if row is None or not row.live():
+        raise LookupError("No such token, or it no longer works.")
+    owner = session.query(User).filter(User.id == row.user_id).one_or_none()
+    if owner is None:
+        raise LookupError("No such token, or it no longer works.")
+    wanted = allowed_scopes(owner, scopes)
+    before = row.scopes or ""
+    row.scopes = ",".join(wanted)
+    session.flush()
+    log.info("api token %s scopes %s -> %s by %s", row.name, before, row.scopes,
+             actor.username)
+    return row, before
+
+
 def create(session, user, name: str, scopes, days: int = DEFAULT_DAYS):
     """-> (row, the token itself).  The only time anybody sees the token."""
     name = (name or "").strip()
     if not name:
         raise ValueError("Give it a name, so somebody can tell later what it was for.")
 
-    wanted = sorted({s.strip() for s in scopes if s.strip() in SCOPES})
-    if "external" in wanted:
-        from app.core import rbac
-
-        if not rbac.can(user, "external.manage"):
-            raise ValueError("Only an administrator's token can work with external sites.")
-    if "approve" in wanted:
-        from app.core import rbac
-
-        if not (rbac.can(user, "waiver.approve") and rbac.can(user, "exclusion.write")):
-            raise ValueError("Only an administrator's token can approve exceptions.")
-    if not wanted:
-        raise ValueError("Pick at least one thing it may do.")
+    wanted = allowed_scopes(user, scopes)
 
     try:
         days = int(days)
 
@@ -3118,6 +3118,46 @@ async def revoke_token(token_id: int, request: Request,
     return redirect("/tokens?msg=" + quote("That token no longer works."))
 
 
+@router.post("/tokens/{token_id}/scopes")
+async def change_token_scopes(token_id: int, request: Request,
+                              user: User = Depends(current_user)):
+    """Change what an existing token may do.  Administrators only.
+
+    The token string stays the same, so the pipeline or editor holding it
+    carries on without being touched.  The scopes are checked against the
+    token's owner, not against the administrator making the change.
+    """
+    await check_csrf(request)
+    rbac.require(user, "user.write")
+
+    from urllib.parse import quote
+
+    from app.core import api_tokens
+
+    form = await request.form()
+    wanted = [scope for scope in api_tokens.SCOPES
+              if _checked(form, f"scope:{scope}")]
+    with session_scope() as db:
+        actor = db.query(User).filter(User.id == user.id).one()
+        try:
+            row, before = api_tokens.set_scopes(db, token_id, wanted, actor)
+        except LookupError:
+            raise HTTPException(status_code=404, detail="No such token.")
+        except ValueError as exc:
+            return redirect(f"/tokens?msg={quote(str(exc))}&kind=error")
+        if before == row.scopes:
+            return redirect("/tokens?msg=" + quote("Nothing changed."))
+        record(db, "api_token.scopes_changed", actor=user.username,
+               target=row.name,
+               detail=f"{before or 'none'} -> {row.scopes} (owner {row.created_by})",
+               source_ip=client_ip(request))
+        name = row.name
+
+    return redirect("/tokens?msg=" + quote(
+        f"{name} may now: {', '.join(wanted)}.  It works the same as before, "
+        "nothing holding it needs to change."))
+
+
 @router.post("/tokens/{token_id}/delete")
 async def delete_token(token_id: int, request: Request,
                        user: User = Depends(current_user)):
 
@@ -3761,6 +3761,15 @@ def tokens_page(request: Request, msg: str = "", kind: str = "",
 
     with session_scope() as db:
         rows = api_tokens.listing(db, user, include_dead=show_dead)
+        # Which tokens belong to somebody who may hold the administrator only
+        # scopes, so the edit form only offers what would be accepted.
+        admin_owned = set()
+        if rbac.can(user, "user.write") and rows:
+            owners = {u.id: u for u in db.query(User).filter(
+                User.id.in_({r.user_id for r in rows})).all()}
+            admin_owned = {r.id for r in rows
+                           if owners.get(r.user_id) is not None
+                           and rbac.can(owners[r.user_id], "waiver.approve")}
         context = _shared(db, user)
         context.update(
             active_page="tokens",
@@ -3771,6 +3780,7 @@ def tokens_page(request: Request, msg: str = "", kind: str = "",
             default_days=api_tokens.DEFAULT_DAYS,
             max_days=api_tokens.MAX_DAYS,
             sees_all=rbac.can(user, "user.write"),
+            admin_owned=admin_owned,
             me=user.username,
             # Shown once, straight after it is made, and never again.  What
             # arrives in the address is a one time key, not the token.
 
@@ -122,7 +122,29 @@
           </td>
           {% if sees_all %}<td class="small">{{ t.created_by }}</td>{% endif %}
           <td class="mono small">{{ t.prefix }}&hellip;</td>
-          <td class="small">{% for s in t.scopes.split(',') %}<span class="badge">{{ s }}</span> {% endfor %}</td>
+          <td class="small">{% for s in t.scopes.split(',') %}<span class="badge">{{ s }}</span> {% endfor %}
+            {% if sees_all and t.live() %}
+            {# Administrators can change what a token may do without anybody
+               having to make a new one and update the secret it lives in. #}
+            <details class="token-scopes">
+              <summary class="small">Edit scopes</summary>
+              <form method="post" action="{{ base }}/tokens/{{ t.id }}/scopes"
+                    data-confirm="Change what this token may do? Whatever holds it gets the new scopes on its next call.">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
+                {% set have = t.scopes.split(',') %}
+                {% for scope, what in scopes.items()
+                       if scope not in ('external', 'approve') or t.id in admin_owned %}
+                <label class="check small" title="{{ what }}">
+                  <input type="checkbox" name="scope:{{ scope }}" value="1"
+                         {{ 'checked' if scope in have }}>
+                  <span class="mono">{{ scope }}</span>
+                </label>
+                {% endfor %}
+                <button class="btn sm" type="submit">Save scopes</button>
+              </form>
+            </details>
+            {% endif %}
+          </td>
           <td class="stack nowrap small">
             {% if t.revoked_at %}<span class="badge critical">revoked</span>
             {% elif not t.live() %}<span class="badge medium">expired</span>