From 1cf91c7e37219672020137434a9c3d7f67d07251 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Tue, 28 Jul 2026 17:35:38 +1000 Subject: [PATCH] gitea roles: add read:user scope for API login validation Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --- .../gitea_secret_backend_role/gitea/teabot-implementer.yaml | 3 +++ config/gitea_secret_backend_role/gitea/teabot-reviewer.yaml | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/config/gitea_secret_backend_role/gitea/teabot-implementer.yaml b/config/gitea_secret_backend_role/gitea/teabot-implementer.yaml index 3f2ce54..8945489 100644 --- a/config/gitea_secret_backend_role/gitea/teabot-implementer.yaml +++ b/config/gitea_secret_backend_role/gitea/teabot-implementer.yaml @@ -2,6 +2,8 @@ # The implementer clones/pushes code and opens pull requests, so it gets write # on repositories (clone + push + PR create) and write on issues (PR/issue # comments). Read is implied by write. No admin/org/user-write scopes. +# read:user is required because tea (and most API clients) validate the login +# via GET /api/v1/user, which 403s without it (verified against a minted token). # Reading gitea/creds/teabot-implementer mints a lease-bound token deleted from # Gitea on revoke/expiry. --- @@ -9,6 +11,7 @@ username: teabot-implementer scopes: - write:repository - write:issue + - read:user token_name_prefix: vault-teabot-implementer ttl: 3600 # 1h max_ttl: 14400 # 4h diff --git a/config/gitea_secret_backend_role/gitea/teabot-reviewer.yaml b/config/gitea_secret_backend_role/gitea/teabot-reviewer.yaml index b1473f4..38a4950 100644 --- a/config/gitea_secret_backend_role/gitea/teabot-reviewer.yaml +++ b/config/gitea_secret_backend_role/gitea/teabot-reviewer.yaml @@ -1,7 +1,9 @@ # Role minting ephemeral tokens for the teabot-reviewer bot user. # The reviewer reads code and posts pull-request reviews/comments, so it gets # read on repositories (fetch diffs) and write on issues (PR reviews + issue/PR -# comments). No repository-write, admin, org, or user scopes. +# comments). No repository-write, admin, org, or user-write scopes. +# read:user is required because tea (and most API clients) validate the login +# via GET /api/v1/user, which 403s without it (verified against a minted token). # Reading gitea/creds/teabot-reviewer mints a lease-bound token deleted from # Gitea on revoke/expiry. --- @@ -9,6 +11,7 @@ username: teabot-reviewer scopes: - read:repository - write:issue + - read:user token_name_prefix: vault-teabot-reviewer ttl: 3600 # 1h max_ttl: 14400 # 4h