vinzenz/hyperhive
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

forge: broaden token scopes for repo create / PRs / orgs / misc

Browse source 
bumped from (read:user,write:repository,write:issue) to also include
write:user (own profile + create repos under own namespace),
write:organization (share namespaces between agents), write:misc
(hooks/attachments). still excludes admin and package scopes.
This commit is contained in:
müde 2026-05-16 20:58:20 +02:00
parent 480d646f69
commit dccbd99b0c
1 changed files with 14 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

19
hive-c0re/src/forge.rs
View file

@ -19,11 +19,20 @@ use crate::coordinator::Coordinator;
const FORGE_CONTAINER: &str = "hive-forge"; const FORGE_CONTAINER: &str = "hive-forge";
const TOKEN_NAME_PREFIX: &str = "hyperhive"; const TOKEN_NAME_PREFIX: &str = "hyperhive";
/// Forgejo scopes the agent's token gets. `write:repository` covers /// Forgejo scopes the agent's token gets. Broad-but-not-admin: every
/// clone/push/repo-create on the user's own repos; `write:issue` is /// repo / PR / issue thing an agent needs day-to-day, no admin
/// what PRs and comments ride under; `read:user` is mandatory for /// surface.
/// the token-owner endpoint clients use to introspect. /// - `write:repository` — create, clone, push, delete repos in the
const TOKEN_SCOPES: &str = "read:user,write:repository,write:issue"; /// user's own namespace; merge PRs.
/// - `write:issue` — open / comment / review issues *and* pull
/// requests (forgejo namespaces PR conversation under issues).
/// - `write:user` — edit own profile, create repos under own user.
/// - `write:organization` — create + manage orgs (lets agents share
/// a forge namespace).
/// - `read:user` — token-owner endpoint clients call to introspect.
/// - `write:misc` — hooks, attachments, the rest of the long tail.
const TOKEN_SCOPES: &str =
"read:user,write:user,write:repository,write:issue,write:organization,write:misc";
/// Token file inside the agent's bind-mounted state dir (visible as /// Token file inside the agent's bind-mounted state dir (visible as
/// `/state/forge-token` from inside the container). /// `/state/forge-token` from inside the container).