Decision: confirm full-scope ("all") for OAuth-minted PATs is intended for the public release #270

New issue

Closed

opened 2026-07-19 03:34:36 +00:00 by hexajon · 1 comment

hexajon commented

2026-07-19 03:34:36 +00:00

(Migrated from codeberg.org)

Surfacing for a conscious pre-release confirmation, not asserting a defect.

internal/config/oauth_mint.go:25 sets oauthMintScopes = []string{"all"}, so the browser-OAuth login flow (madt_auth_login) mints a long-lived PAT with full account scope. A leaked madtea-minted token therefore has full-account blast radius rather than being repo- or issue-scoped. The breadth is surfaced by the post-setup scope audit, and it's a one-line knob.

This was already a deliberate call (recorded in the code, 2026-07-03). The security sweep flags it only because most public users won't notice the scope breadth until after setup, and least-privilege is the usual expectation for a tool that mints tokens on your behalf.

Decision needed: keep all, or narrow the default minted scope for the public release. No code change unless the answer is "narrow it."

Surfacing for a conscious pre-release confirmation, not asserting a defect. `internal/config/oauth_mint.go:25` sets `oauthMintScopes = []string{"all"}`, so the browser-OAuth login flow (`madt_auth_login`) mints a long-lived PAT with full account scope. A leaked madtea-minted token therefore has full-account blast radius rather than being repo- or issue-scoped. The breadth is surfaced by the post-setup scope audit, and it's a one-line knob. This was already a deliberate call (recorded in the code, 2026-07-03). The security sweep flags it only because most public users won't notice the scope breadth until after setup, and least-privilege is the usual expectation for a tool that mints tokens on your behalf. Decision needed: keep `all`, or narrow the default minted scope for the public release. No code change unless the answer is "narrow it."

hexajon commented

2026-07-20 15:13:56 +00:00

(Migrated from codeberg.org)

Decision made (2026-07-20): narrow. Implemented in PR #297 - oauthMintScopes is now the documented Standard tier plus read:organization (write:repository, write:issue, write:notification, read:user, read:organization), pinned element-for-element by TestMintScopes_PinnedSet in internal/config/oauth_mint_test.go so widening is a deliberate reviewed edit. No opt-out flag; broader needs mint a token manually in the forge UI with the paste-based login (documented in PERMISSIONS.md and setup.md). Full gate green on the merged tree.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#270

No description provided.

Rows
Columns