From 31f32aba0f20df9f8a3bd05686f5d133454cb127 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Tue, 28 Jul 2026 18:07:29 +1000 Subject: [PATCH] gitea roles: add read:user scope for API login validation (#105) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit End-to-end verification of the freshly-applied gitea engine (mint → API call → revoke) surfaced that tokens without read:user get 403 from GET /api/v1/user — the endpoint tea and most Gitea API clients use to validate a login. teabot's personalities would fail their auth check with the current scope sets, while in-scope calls (repo/issue) already work and lease revocation correctly kills tokens (verified 401 after revoke). - add read:user to the teabot-implementer role scopes - add read:user to the teabot-reviewer role scopes Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/105 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- .../gitea_secret_backend_role/gitea/teabot-implementer.yaml | 3 +++ config/gitea_secret_backend_role/gitea/teabot-reviewer.yaml | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/config/gitea_secret_backend_role/gitea/teabot-implementer.yaml b/config/gitea_secret_backend_role/gitea/teabot-implementer.yaml index 3f2ce54..8945489 100644 --- a/config/gitea_secret_backend_role/gitea/teabot-implementer.yaml +++ b/config/gitea_secret_backend_role/gitea/teabot-implementer.yaml @@ -2,6 +2,8 @@ # The implementer clones/pushes code and opens pull requests, so it gets write # on repositories (clone + push + PR create) and write on issues (PR/issue # comments). Read is implied by write. No admin/org/user-write scopes. +# read:user is required because tea (and most API clients) validate the login +# via GET /api/v1/user, which 403s without it (verified against a minted token). # Reading gitea/creds/teabot-implementer mints a lease-bound token deleted from # Gitea on revoke/expiry. --- @@ -9,6 +11,7 @@ username: teabot-implementer scopes: - write:repository - write:issue + - read:user token_name_prefix: vault-teabot-implementer ttl: 3600 # 1h max_ttl: 14400 # 4h diff --git a/config/gitea_secret_backend_role/gitea/teabot-reviewer.yaml b/config/gitea_secret_backend_role/gitea/teabot-reviewer.yaml index b1473f4..38a4950 100644 --- a/config/gitea_secret_backend_role/gitea/teabot-reviewer.yaml +++ b/config/gitea_secret_backend_role/gitea/teabot-reviewer.yaml @@ -1,7 +1,9 @@ # Role minting ephemeral tokens for the teabot-reviewer bot user. # The reviewer reads code and posts pull-request reviews/comments, so it gets # read on repositories (fetch diffs) and write on issues (PR reviews + issue/PR -# comments). No repository-write, admin, org, or user scopes. +# comments). No repository-write, admin, org, or user-write scopes. +# read:user is required because tea (and most API clients) validate the login +# via GET /api/v1/user, which 403s without it (verified against a minted token). # Reading gitea/creds/teabot-reviewer mints a lease-bound token deleted from # Gitea on revoke/expiry. --- @@ -9,6 +11,7 @@ username: teabot-reviewer scopes: - read:repository - write:issue + - read:user token_name_prefix: vault-teabot-reviewer ttl: 3600 # 1h max_ttl: 14400 # 4h