From 0b83e5a69eeb768844a5f61bb9881db35467d4f7 Mon Sep 17 00:00:00 2001 From: damocles Date: Sat, 30 May 2026 18:18:56 +0200 Subject: [PATCH] forge: on 403 from PATCH user email, hint operator to delete core token (#646 argus nit) --- hive-c0re/src/forge.rs | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/hive-c0re/src/forge.rs b/hive-c0re/src/forge.rs index a4987bf8..0e63c2ca 100644 --- a/hive-c0re/src/forge.rs +++ b/hive-c0re/src/forge.rs @@ -257,6 +257,17 @@ async fn ensure_user_email(name: &str) { Ok(status) if status.is_success() => { tracing::debug!(%name, %email, "forge: user email aligned"); } + Ok(status) if status == reqwest::StatusCode::FORBIDDEN => { + // Almost certainly an existing-deployment migration case: + // pre-#646 the core token was minted without admin scope, so + // /admin/users/* now returns 403 even though `core` is a + // site admin. Tell the operator how to fix it inline (#646). + tracing::warn!( + %name, %email, %status, + "forge: PATCH user email forbidden — core token likely missing admin scope. \ + Delete {CORE_TOKEN_PATH} and restart hive-c0re to re-mint with the new scopes (#646)." + ); + } Ok(status) => { tracing::warn!(%name, %email, %status, "forge: PATCH user email returned non-success"); }