unkinben
31f32aba0f
ci/woodpecker/push/apply Pipeline was successful
End-to-end verification of the freshly-applied gitea engine (mint → API call → revoke) surfaced that tokens without read:user get 403 from GET /api/v1/user — the endpoint tea and most Gitea API clients use to validate a login. teabot's personalities would fail their auth check with the current scope sets, while in-scope calls (repo/issue) already work and lease revocation correctly kills tokens (verified 401 after revoke). - add read:user to the teabot-implementer role scopes - add read:user to the teabot-reviewer role scopes Reviewed-on: #105 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
18 lines
735 B
YAML
18 lines
735 B
YAML
# Role minting ephemeral tokens for the teabot-implementer bot user.
|
|
# The implementer clones/pushes code and opens pull requests, so it gets write
|
|
# on repositories (clone + push + PR create) and write on issues (PR/issue
|
|
# comments). Read is implied by write. No admin/org/user-write scopes.
|
|
# read:user is required because tea (and most API clients) validate the login
|
|
# via GET /api/v1/user, which 403s without it (verified against a minted token).
|
|
# Reading gitea/creds/teabot-implementer mints a lease-bound token deleted from
|
|
# Gitea on revoke/expiry.
|
|
---
|
|
username: teabot-implementer
|
|
scopes:
|
|
- write:repository
|
|
- write:issue
|
|
- read:user
|
|
token_name_prefix: vault-teabot-implementer
|
|
ttl: 3600 # 1h
|
|
max_ttl: 14400 # 4h
|