Skip to content
Sign in

flagon-io/g1t

public
0
565 linesCodeBlameRaw

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Agents as a team: lifecycle, merge queue, billing and a new shell1//! Access tokens: the `g1t_…` secrets used by git, the API and the MCP
2//! server.
3//!
4//! There is one implementation and two kinds of owner. A personal token
5//! acts as the person who made it. A workspace's token belongs to the
6//! workspace and acts as it, so automation needs no account of its own and
7//! keeps working when the member who set it up leaves.
8
9use g1t_contracts::identity::*;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step10use g1t_contracts::scopes::{FULL_ACCESS, Scope, TokenAccess, parse_scopes, scopes_text};
Agents as a team: lifecycle, merge queue, billing and a new shell11use g1t_contracts::time::{SQL_NOW, rfc3339};
12use g1t_contracts::{FailureCode, Membership, Outcome, PrincipalKind, Role, User, Viewer, new_id};
13use g1t_kit::now_ms;
14use serde::Deserialize;
15use worker::Result;
16use worker::wasm_bindgen::JsValue;
17
18use crate::{Identity, crypto};
19
20pub const TOKEN_PREFIX: &str = "g1t_";
21/// How stale a token's last-used time may get before it is written again.
22const LAST_USED_RESOLUTION_MS: u64 = 5 * 60 * 1000;
23const MAX_TOKENS_PER_WORKSPACE: usize = 50;
24const WORKSPACE_ID_PREFIX: &str = "wsp_";
25
26const TOKEN_COLUMNS: &str = "access_tokens.id, access_tokens.name, access_tokens.created_at,
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step27 access_tokens.last_used_at, users.username AS created_by, access_tokens.scopes,
28 access_tokens.expires_at";
Agents as a team: lifecycle, merge queue, billing and a new shell29
30/// Who a new token belongs to.
31enum Owner<'a> {
32 User(&'a str),
33 Workspace {
34 id: &'a str,
35 created_by: Option<&'a str>,
36 },
37}
38
39#[derive(Deserialize)]
40struct TokenRow {
41 id: String,
42 name: String,
43 created_at: String,
44 last_used_at: Option<String>,
45 created_by: Option<String>,
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step46 scopes: Option<String>,
47 expires_at: Option<String>,
Agents as a team: lifecycle, merge queue, billing and a new shell48}
49
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step50/// What a token or grant may do, as it is to be stored. A token reaches
51/// whatever its owner can; only its scopes narrow that.
52///
53/// The `resources` columns (migration 0022) held a limit to some
54/// workspaces or repositories. That limit was retired (migration 0023);
55/// the columns stay, since D1 cannot drop them in place, and nothing
56/// reads or writes them.
57#[derive(Clone, Debug, Default)]
58pub(crate) struct Grant {
59 /// Null: full access.
60 pub scopes: Option<Vec<Scope>>,
61}
62
63impl Grant {
64 /// From what a caller asked for: unknown scopes are left out.
65 pub(crate) fn asked(scopes: &Option<Vec<String>>) -> Self {
66 Grant {
67 scopes: scopes.as_ref().map(|scopes| parse_scopes(&scopes.join(" "))),
68 }
69 }
70
71 /// The `scopes` column: `*` for full access.
72 pub(crate) fn scopes_column(&self) -> String {
73 match &self.scopes {
74 None => FULL_ACCESS.to_owned(),
75 Some(scopes) => scopes_text(scopes),
Agents as a team: lifecycle, merge queue, billing and a new shell76 }
77 }
78}
79
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step80/// A `scopes` column read back: the scopes (null for full access), and
81/// whether it is a legacy row, made before scopes.
82pub(crate) fn stored_scopes(column: Option<&str>) -> (Option<Vec<String>>, bool) {
83 match column {
84 None => (None, true),
85 Some(FULL_ACCESS) => (None, false),
86 Some(text) => (
87 Some(parse_scopes(text).iter().map(|scope| scope.as_str().to_owned()).collect()),
88 false,
89 ),
90 }
91}
92
Agents as a team: lifecycle, merge queue, billing and a new shell93/// The owner of a token being used.
94#[derive(Deserialize)]
95struct Presented {
96 id: String,
97 user_id: Option<String>,
98 workspace_id: Option<String>,
99 last_used_at: Option<String>,
100 /// Set on an agent's token: what it may do, as JSON `AgentScope`.
101 agent_scope: Option<String>,
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step102 scopes: Option<String>,
Merge the AI Gateway: Anthropic's Messages API on a workspace's tokens103 #[serde(default)]
104 name: Option<String>,
Agents as a team: lifecycle, merge queue, billing and a new shell105}
106
107#[derive(Deserialize)]
108struct WorkspaceRef {
109 id: String,
110 slug: String,
111}
112
113fn text(value: Option<&str>) -> JsValue {
114 value.map_or(JsValue::NULL, JsValue::from)
115}
116
117impl Identity {
118 pub async fn user_for_access_token(&self, token: &str) -> Result<Viewer> {
119 if !token.starts_with(TOKEN_PREFIX) {
120 return Ok(None);
121 }
122 let Some(presented) = self
123 .db
124 .prepare(format!(
Merge the AI Gateway: Anthropic's Messages API on a workspace's tokens125 "SELECT id, user_id, workspace_id, last_used_at, agent_scope, scopes, name
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step126 FROM access_tokens
Agents as a team: lifecycle, merge queue, billing and a new shell127 WHERE token_hash = ? AND (expires_at IS NULL OR expires_at > {SQL_NOW})"
128 ))
129 .bind(&[crypto::sha256_hex(token).into()])?
130 .first::<Presented>(None)
131 .await?
132 else {
133 return Ok(None);
134 };
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent135 // An agent's token: g1t on behalf of the person it was made
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API136 // for, in its repository's workspace while they belong to it, and
137 // only for what its scope lists. See run_credentials.rs.
Agents as a team: lifecycle, merge queue, billing and a new shell138 if let Some(scope) = presented
139 .agent_scope
140 .as_deref()
141 .and_then(|scope| serde_json::from_str::<AgentScope>(scope).ok())
142 {
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API143 return self
144 .agent_principal(
145 &presented.id,
146 presented.user_id.as_deref(),
147 presented.workspace_id.as_deref(),
148 scope,
149 )
150 .await;
Agents as a team: lifecycle, merge queue, billing and a new shell151 }
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step152 let mut viewer = match (&presented.user_id, &presented.workspace_id) {
Agents as a team: lifecycle, merge queue, billing and a new shell153 (Some(user_id), _) => {
154 self.find_user(
155 "SELECT id, username, email_verified_at IS NOT NULL AS verified
156 FROM users WHERE id = ?",
157 user_id,
158 )
159 .await?
160 }
161 (None, Some(workspace_id)) => self.workspace_principal(workspace_id).await?,
162 (None, None) => None,
163 };
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step164 if let Some(user) = viewer.as_mut() {
Agents as a team: lifecycle, merge queue, billing and a new shell165 self.note_use(&presented).await?;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step166 let (scopes, legacy) = stored_scopes(presented.scopes.as_deref());
167 user.token = Some(Box::new(TokenAccess {
168 token_id: presented.id.clone(),
169 scopes,
170 legacy,
Merge the AI Gateway: Anthropic's Messages API on a workspace's tokens171 name: presented.name.clone(),
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step172 }));
Agents as a team: lifecycle, merge queue, billing and a new shell173 }
174 Ok(viewer)
175 }
176
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step177 fn info(row: TokenRow) -> AccessToken {
178 let (scopes, legacy) = stored_scopes(row.scopes.as_deref());
179 AccessToken {
180 id: row.id,
181 name: row.name,
182 created_at: row.created_at,
183 last_used_at: row.last_used_at,
184 created_by: row.created_by,
185 scopes,
186 legacy,
187 expires_at: row.expires_at,
188 }
189 }
190
Agents as a team: lifecycle, merge queue, billing and a new shell191 /// A workspace as the actor behind one of its own tokens. It can do
192 /// what a member can, in that workspace only.
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API193 pub(crate) async fn workspace_principal(&self, workspace_id: &str) -> Result<Viewer> {
Agents as a team: lifecycle, merge queue, billing and a new shell194 let workspace = self
195 .db
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member196 // A deleted workspace's tokens are refused until it is restored.
197 .prepare("SELECT id, slug FROM workspaces WHERE id = ? AND deleted_at IS NULL")
Agents as a team: lifecycle, merge queue, billing and a new shell198 .bind(&[workspace_id.into()])?
199 .first::<WorkspaceRef>(None)
200 .await?;
201 Ok(workspace.map(|workspace| User {
202 id: workspace.id,
203 username: workspace.slug.clone(),
204 kind: PrincipalKind::Workspace,
205 verified: true,
Workspace names and icons, and a component kit for every control206 workspaces: vec![Membership::member(workspace.slug)],
207 ..User::default()
Agents as a team: lifecycle, merge queue, billing and a new shell208 }))
209 }
210
211 async fn note_use(&self, presented: &Presented) -> Result<()> {
212 let now = now_ms();
213 let stale = rfc3339(now.saturating_sub(LAST_USED_RESOLUTION_MS));
214 if presented
215 .last_used_at
216 .as_deref()
217 .is_some_and(|at| at >= stale.as_str())
218 {
219 return Ok(());
220 }
221 self.db
222 .prepare("UPDATE access_tokens SET last_used_at = ? WHERE id = ?")
223 .bind(&[rfc3339(now).into(), presented.id.as_str().into()])?
224 .run()
225 .await?;
226 Ok(())
227 }
228
229 async fn mint(
230 &self,
231 owner: Owner<'_>,
232 name: &str,
233 ttl_seconds: Option<u64>,
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step234 grant: &Grant,
235 listed: bool,
Agents as a team: lifecycle, merge queue, billing and a new shell236 ) -> Result<CreatedAccessToken> {
237 let token = format!("{TOKEN_PREFIX}{}", crypto::random_hex(20));
238 let now = now_ms();
239 let name: String = match name.trim() {
240 "" => "Access token".to_owned(),
241 name => name.chars().take(100).collect(),
242 };
243 let (user_id, workspace_id, created_by) = match owner {
244 Owner::User(id) => (Some(id), None, Some(id)),
245 Owner::Workspace { id, created_by } => (None, Some(id), created_by),
246 };
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step247 let expires_at = ttl_seconds.map(|ttl| rfc3339(now + ttl * 1000));
Agents as a team: lifecycle, merge queue, billing and a new shell248 let info = AccessToken {
249 id: new_id("tok", now),
250 name,
251 created_at: rfc3339(now),
252 last_used_at: None,
253 created_by: None,
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step254 scopes: grant
255 .scopes
256 .as_ref()
257 .map(|scopes| scopes.iter().map(|scope| scope.as_str().to_owned()).collect()),
258 legacy: false,
259 expires_at: expires_at.clone(),
Agents as a team: lifecycle, merge queue, billing and a new shell260 };
261 self.db
262 .prepare(
263 "INSERT INTO access_tokens
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step264 (id, user_id, workspace_id, created_by, name, token_hash, created_at, expires_at,
265 scopes, listed)
266 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
Agents as a team: lifecycle, merge queue, billing and a new shell267 )
268 .bind(&[
269 info.id.as_str().into(),
270 text(user_id),
271 text(workspace_id),
272 text(created_by),
273 info.name.as_str().into(),
274 crypto::sha256_hex(&token).into(),
275 info.created_at.as_str().into(),
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step276 text(expires_at.as_deref()),
277 grant.scopes_column().into(),
278 JsValue::from(u8::from(listed)),
Agents as a team: lifecycle, merge queue, billing and a new shell279 ])?
280 .run()
281 .await?;
282 Ok(CreatedAccessToken { token, info })
283 }
284
285 pub async fn create_access_token(
286 &self,
287 a: CreateAccessTokenArgs,
288 ) -> Result<CreatedAccessToken> {
289 // Told apart by the id, which says what it names, since callers pass
290 // on actors that other services stored as an id and a name.
291 let owner = if a.user.id.starts_with(WORKSPACE_ID_PREFIX) {
292 Owner::Workspace {
293 id: &a.user.id,
294 created_by: None,
295 }
296 } else {
297 Owner::User(&a.user.id)
298 };
Membership as GitHub has it: owners, roles, member privileges, 2FA299 let created = self.mint(owner, &a.name, a.ttl_seconds, &Grant::asked(&a.scopes), a.listed).await?;
300 // A person's lasting token: in their security log and their
301 // workspaces' audit logs. Short-lived ones (agents' runs, OAuth
302 // access tokens) are recorded where they are made.
303 if a.ttl_seconds.is_none() && !a.user.id.starts_with(WORKSPACE_ID_PREFIX) && !a.user.username.is_empty() {
304 self.log_security(&a.user.id, "token_created", Some(&created.info.name), None).await;
305 self.audit_account(&a.user, "token.created", &format!("Created access token {}", created.info.name)).await;
306 }
307 Ok(created)
308 }
309
310 /// `remove_access_token`: deletes one of a person's own tokens.
311 pub async fn remove_access_token(&self, a: RemoveArgs) -> Result<()> {
312 let name: Option<String> = self
313 .db
314 .prepare("DELETE FROM access_tokens WHERE id = ? AND user_id = ? RETURNING name")
315 .bind(&[a.id.as_str().into(), a.user.id.as_str().into()])?
316 .first(Some("name"))
317 .await?;
318 if let Some(name) = name {
319 self.log_security(&a.user.id, "token_deleted", Some(&name), None).await;
320 self.audit_account(&a.user, "token.deleted", &format!("Deleted access token {name}")).await;
321 }
322 Ok(())
Agents as a team: lifecycle, merge queue, billing and a new shell323 }
324
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step325 /// Changes what one of a person's own tokens may do.
326 pub async fn update_access_token(&self, a: UpdateAccessTokenArgs) -> Result<Outcome<AccessToken>> {
327 let grant = Grant::asked(&a.scopes);
328 let found: Option<String> = self
329 .db
330 .prepare(
331 "UPDATE access_tokens SET scopes = ?
332 WHERE id = ? AND user_id = ? AND agent_scope IS NULL
333 RETURNING id",
334 )
335 .bind(&[
336 grant.scopes_column().into(),
337 a.id.as_str().into(),
338 a.user.id.as_str().into(),
339 ])?
340 .first(Some("id"))
341 .await?;
342 if found.is_none() {
343 return Ok(Outcome::fail(FailureCode::NotFound, "No such token."));
344 }
345 let row = self
346 .db
347 .prepare(format!(
348 "SELECT {TOKEN_COLUMNS} FROM access_tokens
349 LEFT JOIN users ON users.id = access_tokens.created_by
350 WHERE access_tokens.id = ?"
351 ))
352 .bind(&[a.id.into()])?
353 .first::<TokenRow>(None)
354 .await?;
355 match row {
Membership as GitHub has it: owners, roles, member privileges, 2FA356 Some(row) => {
357 let info = Self::info(row);
358 self.log_security(&a.user.id, "token_rescoped", Some(&info.name), None).await;
359 self.audit_account(&a.user, "token.rescoped", &format!("Changed the scopes of access token {}", info.name)).await;
360 Ok(Outcome::Ok(info))
361 }
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step362 None => Ok(Outcome::fail(FailureCode::NotFound, "No such token.")),
363 }
364 }
365
Agents as a team: lifecycle, merge queue, billing and a new shell366 /// A token for a g1t agent working for `on_behalf_of`, which can do
367 /// only what `scope` lists. It is recorded as theirs, so it is listed and
368 /// can be deleted with their other tokens.
369 pub async fn create_agent_token(&self, a: CreateAgentTokenArgs) -> Result<CreatedAccessToken> {
370 let created = self
371 .mint(
372 Owner::User(&a.on_behalf_of.id),
373 &format!("g1t agent in {}/{}", a.scope.repo.namespace, a.scope.repo.name),
374 Some(a.ttl_seconds),
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step375 &Grant::default(),
376 false,
Agents as a team: lifecycle, merge queue, billing and a new shell377 )
378 .await?;
379 self.db
380 .prepare("UPDATE access_tokens SET agent_scope = ? WHERE id = ?")
381 .bind(&[
382 serde_json::to_string(&a.scope)?.into(),
383 created.info.id.as_str().into(),
384 ])?
385 .run()
386 .await?;
387 Ok(created)
388 }
389
390 /// What an agent's token may do, or `None` for any other token.
391 pub async fn agent_scope(&self, a: TokenArgs) -> Result<Option<AgentScope>> {
392 let scope: Option<Option<String>> = self
393 .db
394 .prepare(format!(
395 "SELECT agent_scope FROM access_tokens
396 WHERE token_hash = ? AND (expires_at IS NULL OR expires_at > {SQL_NOW})"
397 ))
398 .bind(&[crypto::sha256_hex(&a.token).into()])?
399 .first::<Option<String>>(Some("agent_scope"))
400 .await?;
401 Ok(scope
402 .flatten()
403 .and_then(|scope| serde_json::from_str(&scope).ok()))
404 }
405
406 pub async fn list_access_tokens(&self, a: UserArgs) -> Result<Vec<AccessToken>> {
407 self.tokens_where("access_tokens.user_id = ?", &a.user.id)
408 .await
409 }
410
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step411 /// The tokens a person or workspace made on purpose: those that do not
412 /// expire, and those made with an expiry from settings, rather than
413 /// those issued to an application or a hosted agent.
Agents as a team: lifecycle, merge queue, billing and a new shell414 async fn tokens_where(&self, owner: &str, id: &str) -> Result<Vec<AccessToken>> {
415 let rows = self
416 .db
417 .prepare(format!(
418 "SELECT {TOKEN_COLUMNS} FROM access_tokens
419 LEFT JOIN users ON users.id = access_tokens.created_by
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step420 WHERE {owner} AND (access_tokens.expires_at IS NULL OR access_tokens.listed = 1)
421 AND access_tokens.agent_scope IS NULL
Agents as a team: lifecycle, merge queue, billing and a new shell422 ORDER BY access_tokens.id"
423 ))
424 .bind(&[id.into()])?
425 .all()
426 .await?
427 .results::<TokenRow>()?;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step428 Ok(rows.into_iter().map(Self::info).collect())
Agents as a team: lifecycle, merge queue, billing and a new shell429 }
430
431 pub async fn list_workspace_tokens(
432 &self,
433 a: WorkspaceTokensArgs,
434 ) -> Result<Outcome<Vec<AccessToken>>> {
435 let slug = a.slug.to_lowercase();
436 if !a.viewer.is_some_and(|viewer| viewer.is_member(&slug)) {
437 return Ok(Outcome::fail(
438 FailureCode::Forbidden,
439 "Only members can see a workspace's access tokens.",
440 ));
441 }
442 let Some(workspace) = self.get_workspace(SlugArgs { slug }).await? else {
443 return Ok(Outcome::fail(FailureCode::NotFound, "Workspace not found."));
444 };
445 Ok(Outcome::Ok(
446 self.tokens_where("access_tokens.workspace_id = ?", &workspace.id)
447 .await?,
448 ))
449 }
450
451 /// The workspace's id, if `actor` is a person who owns it.
452 async fn owned_workspace(&self, actor: &User, slug: &str) -> Result<Outcome<String>> {
453 let slug = slug.to_lowercase();
454 if actor.kind != PrincipalKind::User || actor.role_in(&slug) != Some(Role::Owner) {
455 return Ok(Outcome::fail(
456 FailureCode::Forbidden,
457 "Only an owner can manage a workspace's access tokens.",
458 ));
459 }
460 Ok(match self.get_workspace(SlugArgs { slug }).await? {
461 Some(workspace) => Outcome::Ok(workspace.id),
462 None => Outcome::fail(FailureCode::NotFound, "Workspace not found."),
463 })
464 }
465
466 pub async fn create_workspace_token(
467 &self,
468 a: CreateWorkspaceTokenArgs,
469 ) -> Result<Outcome<CreatedAccessToken>> {
470 let workspace_id = match self.owned_workspace(&a.actor, &a.slug).await? {
471 Outcome::Ok(id) => id,
472 Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)),
473 };
474 if a.name.trim().is_empty() {
475 return Ok(Outcome::fail(
476 FailureCode::Invalid,
477 "Name the token after what will use it.",
478 ));
479 }
480 let existing = self
481 .tokens_where("access_tokens.workspace_id = ?", &workspace_id)
482 .await?;
483 if existing.len() >= MAX_TOKENS_PER_WORKSPACE {
484 return Ok(Outcome::fail(
485 FailureCode::Conflict,
486 "This workspace has the maximum number of access tokens. Delete one first.",
487 ));
488 }
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step489 // A workspace's token reaches that workspace only: it acts as the
490 // workspace (see `workspace_principal`), narrowed by its scopes.
491 let grant = Grant::asked(&a.scopes);
Agents as a team: lifecycle, merge queue, billing and a new shell492 let mut created = self
493 .mint(
494 Owner::Workspace {
495 id: &workspace_id,
496 created_by: Some(&a.actor.id),
497 },
498 &a.name,
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step499 a.ttl_seconds,
500 &grant,
501 true,
Agents as a team: lifecycle, merge queue, billing and a new shell502 )
503 .await?;
Membership as GitHub has it: owners, roles, member privileges, 2FA504 created.info.created_by = Some(a.actor.username.clone());
505 self.audit_workspace(
506 &a.actor,
507 "workspace_token.created",
508 &a.slug.to_lowercase(),
509 g1t_contracts::audit::Surface::Web,
510 format!("Created workspace access token {}", created.info.name),
511 )
512 .await;
Agents as a team: lifecycle, merge queue, billing and a new shell513 Ok(Outcome::Ok(created))
514 }
515
516 pub async fn remove_workspace_token(
517 &self,
518 a: RemoveWorkspaceTokenArgs,
519 ) -> Result<Outcome<bool>> {
520 let workspace_id = match self.owned_workspace(&a.actor, &a.slug).await? {
521 Outcome::Ok(id) => id,
522 Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)),
523 };
Membership as GitHub has it: owners, roles, member privileges, 2FA524 let name: Option<String> = self
525 .db
526 .prepare("DELETE FROM access_tokens WHERE id = ? AND workspace_id = ? RETURNING name")
Agents as a team: lifecycle, merge queue, billing and a new shell527 .bind(&[a.id.into(), workspace_id.into()])?
Membership as GitHub has it: owners, roles, member privileges, 2FA528 .first(Some("name"))
Agents as a team: lifecycle, merge queue, billing and a new shell529 .await?;
Membership as GitHub has it: owners, roles, member privileges, 2FA530 if let Some(name) = name {
531 self.audit_workspace(
532 &a.actor,
533 "workspace_token.deleted",
534 &a.slug.to_lowercase(),
535 g1t_contracts::audit::Surface::Web,
536 format!("Deleted workspace access token {name}"),
537 )
538 .await;
539 }
Agents as a team: lifecycle, merge queue, billing and a new shell540 Ok(Outcome::Ok(true))
541 }
542}
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step543
544#[cfg(test)]
545mod tests {
546 use super::*;
547
548 #[test]
549 fn a_row_without_scopes_is_legacy_full_access() {
550 assert_eq!(stored_scopes(None), (None, true));
551 assert_eq!(stored_scopes(Some("*")), (None, false));
552 assert_eq!(
553 stored_scopes(Some("issues:write repo:read nonsense")),
554 (Some(vec!["repo:read".to_owned(), "issues:write".to_owned()]), false)
555 );
556 }
557
558 #[test]
559 fn scopes_are_stored_as_text() {
560 let grant = Grant::asked(&Some(vec!["issues:read".to_owned(), "bogus".to_owned()]));
561 assert_eq!(grant.scopes_column(), "issues:read");
562 assert_eq!(Grant::asked(&None).scopes_column(), "*");
563 assert_eq!(Grant::asked(&Some(vec![])).scopes_column(), "");
564 }
565}

This file's history is long; its oldest lines are credited to the oldest commit read.