Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

g1t.sh
gitagentscloudflarerustforgemcp
106 linesCodeBlameRaw

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

The sidebar asks billing whether it is on, not for the account, so no page waits on the card processor1import assert from "node:assert/strict";
2import { test } from "node:test";
3
4import { DANGEROUS_SCOPES, OAUTH_DEFAULT_SCOPES, SCOPES, SCOPE_GROUPS } from "@g1t/contracts/scopes";
5
6import {
7 accessSummary,
8 consentedScopes,
9 describeExpiry,
10 everyScope,
11 grantFromForm,
12 impliedBy,
13 matchingPreset,
14 normalizeScopes,
15 requestedScopes,
16 scopesFromForm,
17} from "./token-scopes.ts";
18
19function form(fields: Record<string, string | string[]>) {
20 return {
21 get: (name: string) => {
22 const value = fields[name];
23 return Array.isArray(value) ? (value[0] ?? null) : (value ?? null);
24 },
25 getAll: (name: string) => {
26 const value = fields[name];
27 return value === undefined ? [] : Array.isArray(value) ? value : [value];
28 },
29 };
30}
31
32test("every scope is on the checklist exactly once, admin ones under Dangerous", () => {
33 const listed = [...SCOPE_GROUPS.flatMap((group) => group.scopes), ...DANGEROUS_SCOPES];
34 assert.deepEqual([...listed].sort(), SCOPES.map((row) => row.scope).sort());
35 assert.equal(new Set(listed).size, listed.length);
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member36 assert.ok(DANGEROUS_SCOPES.every((scope) => scope.endsWith(":admin") || scope.endsWith(":delete")));
The sidebar asks billing whether it is on, not for the account, so no page waits on the card processor37});
38
39test("ticked boxes store the highest level of each resource", () => {
40 const parsed = scopesFromForm(
41 form({ scope: ["issues:read", "issues:write", "code:read", "agents:run", "bogus:read"] }),
42 );
43 assert.deepEqual(parsed, { ok: true, value: ["code:read", "issues:write", "agents:run"] });
44 assert.deepEqual(normalizeScopes(["repo:read", "repo:admin", "repo:write"]), ["repo:admin"]);
45});
46
47test("full access is null, and nothing ticked is refused", () => {
48 assert.deepEqual(scopesFromForm(form({ preset: "full", scope: "issues:read" })), { ok: true, value: null });
49 assert.equal(scopesFromForm(form({ preset: "full" }), { allowFull: false }).ok, false);
50 assert.equal(scopesFromForm(form({ preset: "custom" })).ok, false);
51 assert.deepEqual(grantFromForm(form({ scope: "memory:read" })), { ok: true, value: { scopes: ["memory:read"] } });
52});
53
54test("a higher level ticks the lower ones of its resource only", () => {
55 assert.equal(impliedBy(["issues:write"], "issues:read"), "issues:write");
56 assert.equal(impliedBy(["repo:admin"], "repo:write"), "repo:admin");
57 assert.equal(impliedBy(["issues:write"], "issues:write"), null);
58 assert.equal(impliedBy(["issues:write"], "pull_requests:read"), null);
59 assert.equal(impliedBy(["code:read"], "code:write"), null);
60});
61
62test("full access ticks the top level of everything", () => {
63 const all = everyScope();
64 assert.ok(all.includes("repo:admin"));
65 assert.ok(all.includes("agents:run"));
66 assert.ok(all.includes("code:write"));
67 assert.ok(!all.includes("code:read"));
68});
69
70test("presets are recognised however their scopes are written", () => {
71 assert.equal(matchingPreset(null), "full");
Merge checks: statuses and check runs on every commit72 assert.equal(matchingPreset(["repo:read", "code:write", "packages:write", "workflows:write", "checks:write", "deployments:write"]), "ci");
The sidebar asks billing whether it is on, not for the account, so no page waits on the card processor73 assert.equal(matchingPreset([...OAUTH_DEFAULT_SCOPES]), "agent");
74 assert.equal(matchingPreset(["issues:read"]), null);
75});
76
77test("a token's access reads plainly", () => {
78 assert.equal(accessSummary({ scopes: null, legacy: true }), "Legacy · full access");
79 assert.equal(accessSummary({ scopes: null, legacy: false }), "Full access");
Merge checks: statuses and check runs on every commit80 assert.equal(accessSummary({ scopes: ["code:read", "code:write", "packages:write", "workflows:write", "checks:write", "deployments:write", "repo:read"], legacy: false }), "CI");
The sidebar asks billing whether it is on, not for the account, so no page waits on the card processor81 assert.equal(accessSummary({ scopes: ["issues:read", "issues:write", "memory:read"], legacy: false }), "2 scopes");
82 assert.equal(accessSummary({ scopes: [], legacy: false }), "No scopes");
83});
84
85test("an application asking for nothing usable gets the default set, never admin", () => {
86 assert.deepEqual(requestedScopes(null), OAUTH_DEFAULT_SCOPES);
87 assert.deepEqual(requestedScopes("openid profile *"), OAUTH_DEFAULT_SCOPES);
88 assert.ok(!requestedScopes("").some((scope) => scope.endsWith(":admin")));
89 assert.deepEqual(requestedScopes("issues:write nonsense repo:read"), ["repo:read", "issues:write"]);
90});
91
92test("consent keeps only what was asked for", () => {
93 const requested = requestedScopes("repo:read issues:read issues:write");
94 assert.deepEqual(consentedScopes(form({ scope: ["issues:write", "repo:admin", "secrets:admin"] }), requested), ["issues:write"]);
95 assert.deepEqual(consentedScopes(form({ scope: ["issues:read", "repo:read"] }), requested), ["repo:read", "issues:read"]);
96 assert.deepEqual(consentedScopes(form({}), requested), []);
97});
98
One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers99test("expiry words", () => {
The sidebar asks billing whether it is on, not for the account, so no page waits on the card processor100 const now = Date.parse("2026-10-05T00:00:00Z");
101 assert.equal(describeExpiry(null, now), "No expiry");
102 assert.equal(describeExpiry("2026-10-04T00:00:00Z", now), "Expired");
103 assert.equal(describeExpiry("2026-10-12T00:00:00Z", now), "Expires in 7 days");
104 assert.equal(describeExpiry("2026-10-05T01:00:00Z", now), "Expires in 1 hour");
105 assert.equal(describeExpiry("2027-01-03T00:00:00Z", now), "Expires in 3 months");
106});

This file's history is long; its oldest lines are credited to the oldest commit read.