vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

forge: drop stale TOKEN_SCOPES/extra.rs cross-reference

Browse source 
extra.rs (external-forge account minting) was removed in the
dashboard-provisioned redesign; TOKEN_SCOPES only applies to tokens
hive-c0re mints itself on the internal forge. External forge tokens
are pasted by the operator verbatim, so we never mint them and don't
need to know their scope.
This commit is contained in:
iris 2026-07-14 18:21:35 +02:00 • committed by mara
commit ec24b96022
1 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
hive-c0re/src/forge/users.rs
View file

@ -29,12 +29,13 @@ use crate::paths::FORGE_CORE_TOKEN as CORE_TOKEN_PATH;
// helpers in `hive_sh4re::assets`. The `agent-configs.png` is
// rendered from its SVG during the `hyperhive-assets` derivation's
// build.
/// Per-agent token scopes (broad-but-not-admin). See
/// `docs/forge.md::Token scopes` for the per-scope rationale.
/// `pub(super)` — also reused by `extra.rs`'s external-forge
/// provisioning so a granted agent gets the same scope set on an
/// extra forge as on the internal one.
pub(super) const TOKEN_SCOPES: &str = "read:user,write:user,read:notification,write:notification,write:repository,write:issue,write:organization,write:misc";
/// Per-agent token scopes (broad-but-not-admin) for tokens hive-c0re
/// mints itself on the **internal** forge. See `docs/forge.md::Token
/// scopes` for the per-scope rationale. Not `pub(super)` — external
/// forges (`dashboard/extra_forges.rs`) take an operator-pasted token
/// verbatim, so their scope is whatever the operator's remote account
/// happened to grant; we never mint there and don't need to know it.
const TOKEN_SCOPES: &str = "read:user,write:user,read:notification,write:notification,write:repository,write:issue,write:organization,write:misc";
/// Bootstrap `core` token scopes — adds `read:admin,write:admin` on
/// top of `TOKEN_SCOPES` so the host daemon can drive