gitea: the token needs read:user, not just write:repository and write:issue #51

2026-09-24T09:43:59Z

jschoubben commented

2026-09-24 09:43:59 +00:00

Follow-up to #49, which just deployed. The watcher immediately broke:

[gitea] not watching until this clears — Gitea API /user/repos?page=1&limit=50: 403
  {"message":"token does not have at least one of required scope(s), required=[read:user], token scope=write:issue,write:repository", ...}

Confirmed live against the running forge (1.27.3): GET /user/repos sits under gitea's user scope category, not repository — despite listing repositories. #49's review checked the route-category source and got this one wrong; the live instance is the ground truth here.

Fix: add read:user to TOKEN_SCOPES.

Also: the fake forge in token.test.ts never enforced scopes on /user/repos — it only checked the token's value was valid, which is why the original test suite passed despite the bug. Added scope enforcement there too (mirroring gitea's write:X implies read:X rule) so a regression like this fails a test next time instead of shipping quietly.

Operational note, same shape as #49's own: the token this node already minted under #49 is stuck with the old scopes and kept at /var/lib/mesh/gitea/state/token — the client only renews on 401, and this is a 403, so it won't self-heal. Once this merges and rolls out, that kept file needs clearing by hand (or the forge-side mesh-tools token deleted by name) so it re-mints with the corrected scope.

Not independently verified with npm test — this environment's @novox npm registry access didn't resolve for me (checked both npm.novox.be and the mesh's own verdaccio; neither served @novox/mesh-sdk). The scope requirement itself is not a guess: it's the forge's own 403 response, reproduced live. Worth a second pair of eyes running the suite before merge if that's available to you.

Follow-up to #49, which just deployed. The watcher immediately broke: ``` [gitea] not watching until this clears — Gitea API /user/repos?page=1&limit=50: 403 {"message":"token does not have at least one of required scope(s), required=[read:user], token scope=write:issue,write:repository", ...} ``` Confirmed live against the running forge (1.27.3): `GET /user/repos` sits under gitea's `user` scope category, not `repository` — despite listing repositories. #49's review checked the route-category source and got this one wrong; the live instance is the ground truth here. **Fix:** add `read:user` to `TOKEN_SCOPES`. **Also:** the fake forge in `token.test.ts` never enforced scopes on `/user/repos` — it only checked the token's *value* was valid, which is why the original test suite passed despite the bug. Added scope enforcement there too (mirroring gitea's `write:X implies read:X` rule) so a regression like this fails a test next time instead of shipping quietly. **Operational note, same shape as #49's own:** the token this node already minted under #49 is stuck with the old scopes and kept at `/var/lib/mesh/gitea/state/token` — the client only renews on `401`, and this is a `403`, so it won't self-heal. Once this merges and rolls out, that kept file needs clearing by hand (or the forge-side `mesh-tools` token deleted by name) so it re-mints with the corrected scope. **Not independently verified with `npm test`** — this environment's `@novox` npm registry access didn't resolve for me (checked both `npm.novox.be` and the mesh's own `verdaccio`; neither served `@novox/mesh-sdk`). The scope requirement itself is not a guess: it's the forge's own 403 response, reproduced live. Worth a second pair of eyes running the suite before merge if that's available to you.

jschoubben added 1 commit 2026-09-24 09:44:00 +00:00

gitea: the token needs read:user, not just write:repository and write:issue aaf341a2d8

Deployed #49 and the watcher immediately broke: GET /user/repos answered 403,
'required=[read:user]' — confirmed live against the running forge (1.27.3).
That route sits under gitea's user scope category despite listing
repositories, not repository as assumed.

Also gives the fake forge real scope enforcement on /user/repos, which is
why the original PR's test suite didn't catch this: it only checked the
token's value was valid, never that it carried the required scope.

jschoubben merged commit 415ad7a168 into main

2026-09-24 09:49:37 +00:00

jschoubben deleted branch fix/gitea-user-repos-scope

2026-09-24 09:49:37 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#51