main · last commit
5 hours ago ·
ti41arbu
sr-ht-dolt-xic Grant scope: publish DATABASES, not lowercase repos
Past Stand
bd reopen sr-ht-dolt-xic
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-08-18T09:15:16Z |
| Started | 2026-08-18T09:15:33Z |
| Updated | 2026-08-18T09:21:12Z |
| Closed | 2026-08-18T09:21:12Z |
api-meta.json publishes the scope as lowercase "repos" while every other service on the instance publishes UPPERCASE (git: REPOSITORIES/OBJECTS/ACLS, todo: TRACKERS/TICKETS, paste: PASTES, builds: JOBS/LOGS/SECRETS). meta.sr.ht validate_grants (metasrht/blueprints/oauth2.py) compares the scope string strictly, so a grant spelled by hand as dolt.sr.ht/REPOS:RO is refused today. Rename the published scope and the enforced grant to DATABASES — the entity this service exposes in GraphQL and the web UI is a database — and align the scope-layer identifiers (authn.RepoScope, cmd/doltsrht.repoScopeName). No backward compatibility: the old spelling is dropped, PATs carrying dolt.sr.ht/repos must be re-minted.
authn scope constant is dolt.sr.ht/DATABASES; api-meta.json serves {"scopes":["DATABASES"]}; the equality test still binds the two; grants spelled with the old lowercase name are refused; README and docs/DESIGN.md updated
No outgoing dependencies.
Nothing depends on this issue.
| id | sr-ht-dolt-xic |
| content_hash | faba3ec0ac5a3015cea6ea0ba505dcb77501002b1437fb2a8479be93016a5cb2 |
| title | Grant scope: publish DATABASES, not lowercase repos |
| description | api-meta.json publishes the scope as lowercase "repos" while every other service on the instance publishes UPPERCASE (git: REPOSITORIES/OBJECTS/ACLS, todo: TRACKERS/TICKETS, paste: PASTES, builds: JOBS/LOGS/SECRETS). meta.sr.ht validate_grants (metasrht/blueprints/oauth2.py) compares the scope string strictly, so a grant spelled by hand as dolt.sr.ht/REPOS:RO is refused today. Rename the published scope and the enforced grant to DATABASES — the entity this service exposes in GraphQL and the web UI is a database — and align the scope-layer identifiers (authn.RepoScope, cmd/doltsrht.repoScopeName). No backward compatibility: the old spelling is dropped, PATs carrying dolt.sr.ht/repos must be re-minted. |
| design | |
| acceptance_criteria | authn scope constant is dolt.sr.ht/DATABASES; api-meta.json serves {"scopes":["DATABASES"]}; the equality test still binds the two; grants spelled with the old lowercase name are refused; README and docs/DESIGN.md updated |
| notes | |
| status | closed |
| priority | 2 |
| issue_type | bug |
| assignee | Eugene Blikh |
| estimated_minutes | NULL |
| created_at | 2026-08-18T09:15:16Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-08-18T09:21:12Z |
| closed_at | 2026-08-18T09:21:12Z |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | �{} |
| source_repo | |
| close_reason | Scope renamed to dolt.sr.ht/DATABASES in b525a62; deeper repo->database rename split out |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | 2026-08-18T09:15:33Z |
| is_blocked | 0 |
| id | 01a01427-4f2b-74ce-b047-22aecfe81b29 |
| issue_id | sr-ht-dolt-xic |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-08-18T12:15:15Z |
| id | 01a01427-911b-7232-9d2b-362a03424b6e |
| issue_id | sr-ht-dolt-xic |
| event_type | claimed |
| actor | Eugene Blikh |
| old_value | {"id":"sr-ht-dolt-xic","title":"Grant scope: publish DATABASES, not lowercase repos","description":"api-meta.json publishes the scope as lowercase \"repos\" while every other service on the instance publishes UPPERCASE (git: REPOSITORIES/OBJECTS/ACLS, todo: TRACKERS/TICKETS, paste: PASTES, builds: JOBS/LOGS/SECRETS). meta.sr.ht validate_grants (metasrht/blueprints/oauth2.py) compares the scope string strictly, so a grant spelled by hand as dolt.sr.ht/REPOS:RO is refused today. Rename the published scope and the enforced grant to DATABASES — the entity this service exposes in GraphQL and the web UI is a database — and align the scope-layer identifiers (authn.RepoScope, cmd/doltsrht.repoScopeName). No backward compatibility: the old spelling is dropped, PATs carrying dolt.sr.ht/repos must be re-minted.","acceptance_criteria":"authn scope constant is dolt.sr.ht/DATABASES; api-meta.json serves {\"scopes\":[\"DATABASES\"]}; the equality test still binds the two; grants spelled with the old lowercase name are refused; README and docs/DESIGN.md updated","status":"open","priority":2,"issue_type":"bug","owner":"bigbes@gmail.com","created_at":"2026-08-18T09:15:16Z","created_by":"Eugene Blikh","updated_at":"2026-08-18T09:15:16Z"} |
| new_value | {"assignee":"Eugene Blikh","status":"in_progress"} |
| comment | NULL |
| created_at | 2026-08-18T12:15:32Z |
| id | 01a0142c-c011-72e6-bbb3-330b69ea37e8 |
| issue_id | sr-ht-dolt-xic |
| event_type | closed |
| actor | Eugene Blikh |
| old_value | |
| new_value | Scope renamed to dolt.sr.ht/DATABASES in b525a62; deeper repo->database rename split out |
| comment | NULL |
| created_at | 2026-08-18T12:21:12Z |
No comments.
Close reason