unkinben
31f32aba0f
ci/woodpecker/push/apply Pipeline was successful
End-to-end verification of the freshly-applied gitea engine (mint → API call → revoke) surfaced that tokens without read:user get 403 from GET /api/v1/user — the endpoint tea and most Gitea API clients use to validate a login. teabot's personalities would fail their auth check with the current scope sets, while in-scope calls (repo/issue) already work and lease revocation correctly kills tokens (verified 401 after revoke). - add read:user to the teabot-implementer role scopes - add read:user to the teabot-reviewer role scopes Reviewed-on: #105 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
18 lines
723 B
YAML
18 lines
723 B
YAML
# Role minting ephemeral tokens for the teabot-reviewer bot user.
|
|
# The reviewer reads code and posts pull-request reviews/comments, so it gets
|
|
# read on repositories (fetch diffs) and write on issues (PR reviews + issue/PR
|
|
# comments). No repository-write, admin, org, or user-write scopes.
|
|
# read:user is required because tea (and most API clients) validate the login
|
|
# via GET /api/v1/user, which 403s without it (verified against a minted token).
|
|
# Reading gitea/creds/teabot-reviewer mints a lease-bound token deleted from
|
|
# Gitea on revoke/expiry.
|
|
---
|
|
username: teabot-reviewer
|
|
scopes:
|
|
- read:repository
|
|
- write:issue
|
|
- read:user
|
|
token_name_prefix: vault-teabot-reviewer
|
|
ttl: 3600 # 1h
|
|
max_ttl: 14400 # 4h
|