sec(auth): OAuth-minted PATs default to least privilege - Standard tier + read:organization #297

Merged

hexajon merged 1 commit from issue-270-decision-confirm-full-scope-all-for-oauth-minted-p into main

2026-07-20 15:13:35 +00:00

hexajon commented

2026-07-20 15:10:02 +00:00

(Migrated from codeberg.org)

Summary

Implements the owner decision on #270 (2026-07-20): narrow, no opt-out flag.

oauthMintScopes changes from ["all"] to ["write:repository", "write:issue", "write:notification", "read:user", "read:organization"] - the documented Standard tier plus org-label name resolution. write:X implies read:X in the Forgejo/Gitea scope model. Deliberately excluded: write:organization, package, admin, misc, activitypub - the existing 403 scope-hint machinery teaches those on demand, and broader needs use a manually-minted forge-UI token with the paste-based login.
Pinned by TestMintScopes_PinnedSet (exact element-for-element assertion) and the happy-path mint test now asserting the full list - widening is a deliberate, reviewed edit.
Docs reconciled: PERMISSIONS.md states what --web mints and the manual path for broader scope; setup.md's --web section names the minted scope set. The MCP tool description, CLI help, SECURITY.md, and credential-safety.md were verified to make no full-scope claims - untouched. Scope audit needs no change and renders narrowed tokens correctly.

Full gate green (all cheap checks + test-race, staticcheck, govulncheck, gosec, modernize, docs-verify, cross-compile, mcp-conformance: PASS).

Closes #270

## Summary Implements the owner decision on #270 (2026-07-20): narrow, no opt-out flag. - `oauthMintScopes` changes from ["all"] to ["write:repository", "write:issue", "write:notification", "read:user", "read:organization"] - the documented Standard tier plus org-label name resolution. write:X implies read:X in the Forgejo/Gitea scope model. Deliberately excluded: write:organization, package, admin, misc, activitypub - the existing 403 scope-hint machinery teaches those on demand, and broader needs use a manually-minted forge-UI token with the paste-based login. - Pinned by TestMintScopes_PinnedSet (exact element-for-element assertion) and the happy-path mint test now asserting the full list - widening is a deliberate, reviewed edit. - Docs reconciled: PERMISSIONS.md states what --web mints and the manual path for broader scope; setup.md's --web section names the minted scope set. The MCP tool description, CLI help, SECURITY.md, and credential-safety.md were verified to make no full-scope claims - untouched. Scope audit needs no change and renders narrowed tokens correctly. Full gate green (all cheap checks + test-race, staticcheck, govulncheck, gosec, modernize, docs-verify, cross-compile, mcp-conformance: PASS). Closes #270

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea!297

No description provided.

Rows
Columns