gitea: the tools' forge account reads every repository (the operator, 2026-10-26) #495

2026-10-26T12:45:13Z

mesh-tools commented

2026-10-26 12:45:13 +00:00

The operator decided 2026-10-26: the forge account the mesh's tools act as (mesh-tools) reads every repository. Until now it read the novox organisation's repositories (through its team) and public ones, so a user's private repositories (car-hunter, snake) answered 404 to the tools, the indexer and the checker, and the grants part composes their modules with no authority (issue 1945's gaps).

modules/gitea/readall.ts (new): with the module's existing administrator login, adds mesh-tools as a read-only collaborator on each repository it cannot read (one repository at a time, no organisation membership), checks each grant by reading the permission back, and says each refusal in the forge's words. A repository whose permission cannot be read is a refusal for that repository alone; the pass goes on.
When: one pass at the start (not awaited; asked again a minute apart until one pass ran), and on the forge's events: a repository made, a fork, or the first event of a repository not yet seen readable. Not caught: a repository made private after it was seen readable (the forge sends no visibility event): granted at the next start or by gitea_grant_read, and shown by gitea_unreadable_repos meanwhile.
Tools: gitea_unreadable_repos (each repository the account cannot read, its permission and why) and gitea_grant_read (the same grant by hand, all or named repositories).
The administrator login is used for these four calls only; it never reaches a log or a tool answer.

Tests: two cases in test/tools-account.test.ts against an extended fake forge (start pass over six repositories; events, a refused grant, a 500 on one permission read). npm test 204 of 204; the new rows fail without the change.

Rule bent (rules-are-weighed): no try before this pull request. The try at 0e7e220d was stranded by the bus reload at 13:26 (issue 734, fix in progress) and the checker hands back the stranded run for this repository; the merge check is the gate.

Reviewed-by: review-forgeread@shanks at b4a7bb9dea

The operator decided 2026-10-26: the forge account the mesh's tools act as (`mesh-tools`) reads every repository. Until now it read the novox organisation's repositories (through its team) and public ones, so a user's private repositories (car-hunter, snake) answered 404 to the tools, the indexer and the checker, and the grants part composes their modules with no authority (issue 1945's gaps). - `modules/gitea/readall.ts` (new): with the module's existing administrator login, adds `mesh-tools` as a read-only collaborator on each repository it cannot read (one repository at a time, no organisation membership), checks each grant by reading the permission back, and says each refusal in the forge's words. A repository whose permission cannot be read is a refusal for that repository alone; the pass goes on. - When: one pass at the start (not awaited; asked again a minute apart until one pass ran), and on the forge's events: a repository made, a fork, or the first event of a repository not yet seen readable. Not caught: a repository made private after it was seen readable (the forge sends no visibility event): granted at the next start or by `gitea_grant_read`, and shown by `gitea_unreadable_repos` meanwhile. - Tools: `gitea_unreadable_repos` (each repository the account cannot read, its permission and why) and `gitea_grant_read` (the same grant by hand, all or named repositories). - The administrator login is used for these four calls only; it never reaches a log or a tool answer. Tests: two cases in test/tools-account.test.ts against an extended fake forge (start pass over six repositories; events, a refused grant, a 500 on one permission read). `npm test` 204 of 204; the new rows fail without the change. Rule bent (rules-are-weighed): no try before this pull request. The try at 0e7e220d was stranded by the bus reload at 13:26 (issue 734, fix in progress) and the checker hands back the stranded run for this repository; the merge check is the gate. Reviewed-by: review-forgeread@shanks at b4a7bb9dea506ee73cb2a86663d9be5fc17b922c

mesh-tools added 2 commits 2026-10-26 12:45:14 +00:00

gitea: give the tools' account read on every repository, at the start and on the forge's events, so a user's private repository no longer answers its tools 404 0e7e220d49

gitea: say that a repository made private later is granted only at the next start or by hand, and let one unreadable permission refuse its repository, not the whole pass

mesh/delivery merged: source.main moved to novox/mesh-catalog@a4f5df797b68

Details

mesh/check being carried to b4a7bb9dea50 on a4f5df797b68

b4a7bb9dea

mesh-tools commented

2026-10-26 12:45:16 +00:00

Delivery novox/mesh-catalog@b4a7bb9dea50 — merged since 2026-10-26T12:46:40Z

Source — source.main moved to novox/mesh-catalog@a4f5df797b. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-10-26 12:45 (new) → proposed (announced): novox/mesh-catalog#495's head announced
2026-10-26 12:45 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-26 12:46 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@b4a7bb9dea50` — **merged** since 2026-10-26T12:46:40Z **Source** — source.main moved to novox/mesh-catalog@a4f5df797b68. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-10-26 12:45 (new) → proposed (announced): novox/mesh-catalog#495's head announced - 2026-10-26 12:45 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-26 12:46 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit a4f5df797b into main

2026-10-26 12:46:37 +00:00

mesh-tools deleted branch fix/forge-account-reads-all

2026-10-26 12:46:38 +00:00

jschoubben referenced this issue from a commit

2026-10-26 14:18:56 +00:00

The mesh's forge accounts all read every repository, and a build's fetch says the forge's own words

jschoubben referenced this issue from a commit

2026-10-26 14:21:23 +00:00

The mesh's forge accounts all read every repository, and a build's fetch says the forge's own words

jschoubben referenced this issue from a commit

2026-10-26 14:24:23 +00:00