flagon-io/g1t

public

1	//! Scopes: what an access token may do on its owner's behalf.
2	//!
3	//! A personal access token, a workspace's token and an application signed
4	//! in with OAuth each carry a set of scopes. A token reaches whatever the
5	//! one it acts as can reach: a person's token, that person's workspaces and
6	//! repositories; a workspace's token, that workspace. What a request may do
7	//! is the intersection of two things: the role of whoever the token acts as
8	//! (see [`crate::access`]) and the token's scopes.
9	//!
10	//! Each scope is a resource and a level, written `resource:level`, such as
11	//! `issues:write`. A higher level of a resource includes the lower ones:
12	//! `repo:admin` includes `repo:write`, which includes `repo:read`.
13	//!
14	//! This module is the one source of truth: the API (REST and MCP) and git
15	//! enforce it, and identity stores it. `packages/contracts/src/scopes.ts`
16	//! mirrors the table for the site; a test keeps the two the same.
17
18	use serde::{Deserialize, Serialize};
19
20	use crate::credentials::Decision;
21
22	/// Something a token can be given access to.
23	#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
24	pub enum Resource {
25	Account,
26	Notifications,
27	/// Chat: the conversations a person is in (channels, direct messages,
28	/// threads), read and answered as them on the site's chat routes and
29	/// live sockets. A person's own; no preset gives it.
30	Chat,
31	Workspace,
32	Billing,
33	Repo,
34	Code,
35	Security,
36	Packages,
37	Issues,
38	PullRequests,
39	Agents,
40	Workflows,
41	WorkflowFiles,
42	Checks,
43	Deployments,
44	Memory,
45	Access,
46	Webhooks,
47	Secrets,
48	Runners,
49	Models,
50	/// Artifacts mode's docs, slides, designs and dashboards (folios in
51	/// code): the `artifact` MCP tool and `/workspaces/{ws}/artifacts`.
52	/// Not workflow runs' artifacts, which are `workflows:*`.
53	Artifacts,
54	}
55
56	impl Resource {
57	pub const ALL: [Resource; 23] = [
58	Resource::Repo,
59	Resource::Code,
60	Resource::Security,
61	Resource::Packages,
62	Resource::Issues,
63	Resource::PullRequests,
64	Resource::Agents,
65	Resource::Workflows,
66	Resource::WorkflowFiles,
67	Resource::Checks,
68	Resource::Deployments,
69	Resource::Memory,
70	Resource::Account,
71	Resource::Notifications,
72	Resource::Chat,
73	Resource::Workspace,
74	Resource::Billing,
75	Resource::Access,
76	Resource::Webhooks,
77	Resource::Secrets,
78	Resource::Runners,
79	Resource::Models,
80	Resource::Artifacts,
81	];
82
83	pub fn as_str(self) -> &'static str {
84	match self {
85	Resource::Account => "account",
86	Resource::Notifications => "notifications",
87	Resource::Chat => "chat",
88	Resource::Workspace => "workspace",
89	Resource::Billing => "billing",
90	Resource::Repo => "repo",
91	Resource::Code => "code",
92	Resource::Security => "security",
93	Resource::Packages => "packages",
94	Resource::Issues => "issues",
95	Resource::PullRequests => "pull_requests",
96	Resource::Agents => "agents",
97	Resource::Workflows => "workflows",
98	Resource::WorkflowFiles => "workflow_files",
99	Resource::Checks => "checks",
100	Resource::Deployments => "deployments",
101	Resource::Memory => "memory",
102	Resource::Access => "access",
103	Resource::Webhooks => "webhooks",
104	Resource::Secrets => "secrets",
105	Resource::Runners => "runners",
106	Resource::Models => "models",
107	Resource::Artifacts => "artifacts",
108	}
109	}
110
111	/// Its name, for people.
112	pub fn label(self) -> &'static str {
113	match self {
114	Resource::Account => "Your account",
115	Resource::Notifications => "Notifications",
116	Resource::Chat => "Chat",
117	Resource::Workspace => "Workspaces",
118	Resource::Billing => "Billing",
119	Resource::Repo => "Repositories",
120	Resource::Code => "Code",
121	Resource::Security => "Security",
122	Resource::Packages => "Packages",
123	Resource::Issues => "Issues",
124	Resource::PullRequests => "Pull requests",
125	Resource::Agents => "g1t agents",
126	Resource::Workflows => "Workflows",
127	Resource::WorkflowFiles => "Workflow files",
128	Resource::Checks => "Checks and statuses",
129	Resource::Deployments => "Deployments",
130	Resource::Memory => "Memory and context",
131	Resource::Access => "Who has access",
132	Resource::Webhooks => "Webhooks",
133	Resource::Secrets => "Secrets and variables",
134	Resource::Runners => "Self-hosted runners",
135	Resource::Models => "AI Gateway",
136	Resource::Artifacts => "Artifacts",
137	}
138	}
139
140	/// Whether tokens are offered it yet. A resource being built can be in
141	/// the table before its API ships (so its scopes parse, and the
142	/// TypeScript mirror lists it under `UPCOMING_RESOURCES`) while nothing
143	/// hands it out: presets, full access, OAuth and the token form leave
144	/// it out, and no operation needs it. Every resource is offered now;
145	/// Artifacts was the last.
146	pub fn offered(self) -> bool {
147	let _ = self;
148	true
149	}
150	}
151
152	/// How much of a resource.
153	#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
154	pub enum Level {
155	Read,
156	Write,
157	/// Starting g1t's agents, which spends the workspace's money.
158	Run,
159	/// Deleting what cannot be brought back, such as a package's versions.
160	Delete,
161	Admin,
162	}
163
164	impl Level {
165	pub fn as_str(self) -> &'static str {
166	match self {
167	Level::Read => "read",
168	Level::Write => "write",
169	Level::Run => "run",
170	Level::Delete => "delete",
171	Level::Admin => "admin",
172	}
173	}
174	}
175
176	/// One scope. Its text form, `resource:level`, is what tokens store, OAuth
177	/// clients ask for, and errors name.
178	#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
179	pub enum Scope {
180	RepoRead,
181	RepoWrite,
182	RepoAdmin,
183	CodeRead,
184	CodeWrite,
185	SecurityRead,
186	SecurityWrite,
187	PackagesRead,
188	PackagesWrite,
189	PackagesDelete,
190	IssuesRead,
191	IssuesWrite,
192	PullRequestsRead,
193	PullRequestsWrite,
194	AgentsRun,
195	WorkflowsRead,
196	WorkflowsWrite,
197	WorkflowFilesWrite,
198	ChecksRead,
199	ChecksWrite,
200	DeploymentsRead,
201	DeploymentsWrite,
202	MemoryRead,
203	MemoryWrite,
204	AccountRead,
205	AccountWrite,
206	NotificationsRead,
207	NotificationsWrite,
208	ChatRead,
209	ChatWrite,
210	WorkspaceRead,
211	WorkspaceAdmin,
212	BillingRead,
213	BillingWrite,
214	AccessRead,
215	AccessAdmin,
216	WebhooksRead,
217	WebhooksAdmin,
218	SecretsRead,
219	SecretsAdmin,
220	RunnersRead,
221	RunnersAdmin,
222	ModelsRead,
223	ModelsWrite,
224	ArtifactsRead,
225	ArtifactsWrite,
226	ArtifactsAdmin,
227	}
228
229	impl Scope {
230	/// Every scope, grouped by resource, least first.
231	pub const ALL: [Scope; 47] = [
232	Scope::RepoRead,
233	Scope::RepoWrite,
234	Scope::RepoAdmin,
235	Scope::CodeRead,
236	Scope::CodeWrite,
237	Scope::SecurityRead,
238	Scope::SecurityWrite,
239	Scope::PackagesRead,
240	Scope::PackagesWrite,
241	Scope::PackagesDelete,
242	Scope::IssuesRead,
243	Scope::IssuesWrite,
244	Scope::PullRequestsRead,
245	Scope::PullRequestsWrite,
246	Scope::AgentsRun,
247	Scope::WorkflowsRead,
248	Scope::WorkflowsWrite,
249	Scope::WorkflowFilesWrite,
250	Scope::ChecksRead,
251	Scope::ChecksWrite,
252	Scope::DeploymentsRead,
253	Scope::DeploymentsWrite,
254	Scope::MemoryRead,
255	Scope::MemoryWrite,
256	Scope::AccountRead,
257	Scope::AccountWrite,
258	Scope::NotificationsRead,
259	Scope::NotificationsWrite,
260	Scope::ChatRead,
261	Scope::ChatWrite,
262	Scope::WorkspaceRead,
263	Scope::WorkspaceAdmin,
264	Scope::BillingRead,
265	Scope::BillingWrite,
266	Scope::AccessRead,
267	Scope::AccessAdmin,
268	Scope::WebhooksRead,
269	Scope::WebhooksAdmin,
270	Scope::SecretsRead,
271	Scope::SecretsAdmin,
272	Scope::RunnersRead,
273	Scope::RunnersAdmin,
274	Scope::ModelsRead,
275	Scope::ModelsWrite,
276	Scope::ArtifactsRead,
277	Scope::ArtifactsWrite,
278	Scope::ArtifactsAdmin,
279	];
280
281	pub fn as_str(self) -> &'static str {
282	match self {
283	Scope::RepoRead => "repo:read",
284	Scope::RepoWrite => "repo:write",
285	Scope::RepoAdmin => "repo:admin",
286	Scope::CodeRead => "code:read",
287	Scope::CodeWrite => "code:write",
288	Scope::SecurityRead => "security:read",
289	Scope::SecurityWrite => "security:write",
290	Scope::PackagesRead => "packages:read",
291	Scope::PackagesWrite => "packages:write",
292	Scope::PackagesDelete => "packages:delete",
293	Scope::IssuesRead => "issues:read",
294	Scope::IssuesWrite => "issues:write",
295	Scope::PullRequestsRead => "pull_requests:read",
296	Scope::PullRequestsWrite => "pull_requests:write",
297	Scope::AgentsRun => "agents:run",
298	Scope::WorkflowsRead => "workflows:read",
299	Scope::WorkflowsWrite => "workflows:write",
300	Scope::WorkflowFilesWrite => "workflow_files:write",
301	Scope::ChecksRead => "checks:read",
302	Scope::ChecksWrite => "checks:write",
303	Scope::DeploymentsRead => "deployments:read",
304	Scope::DeploymentsWrite => "deployments:write",
305	Scope::MemoryRead => "memory:read",
306	Scope::MemoryWrite => "memory:write",
307	Scope::AccountRead => "account:read",
308	Scope::AccountWrite => "account:write",
309	Scope::NotificationsRead => "notifications:read",
310	Scope::NotificationsWrite => "notifications:write",
311	Scope::ChatRead => "chat:read",
312	Scope::ChatWrite => "chat:write",
313	Scope::WorkspaceRead => "workspace:read",
314	Scope::WorkspaceAdmin => "workspace:admin",
315	Scope::BillingRead => "billing:read",
316	Scope::BillingWrite => "billing:write",
317	Scope::AccessRead => "access:read",
318	Scope::AccessAdmin => "access:admin",
319	Scope::WebhooksRead => "webhooks:read",
320	Scope::WebhooksAdmin => "webhooks:admin",
321	Scope::SecretsRead => "secrets:read",
322	Scope::SecretsAdmin => "secrets:admin",
323	Scope::RunnersRead => "runners:read",
324	Scope::RunnersAdmin => "runners:admin",
325	Scope::ModelsRead => "models:read",
326	Scope::ModelsWrite => "models:write",
327	Scope::ArtifactsRead => "artifacts:read",
328	Scope::ArtifactsWrite => "artifacts:write",
329	Scope::ArtifactsAdmin => "artifacts:admin",
330	}
331	}
332
333	pub fn parse(text: &str) -> Option<Scope> {
334	let text = text.trim().to_ascii_lowercase();
335	Scope::ALL.into_iter().find(\|scope\| scope.as_str() == text)
336	}
337
338	pub fn resource(self) -> Resource {
339	let name = self.as_str().split_once(':').map_or("", \|(resource, _)\| resource);
340	Resource::ALL
341	.into_iter()
342	.find(\|resource\| resource.as_str() == name)
343	.unwrap_or(Resource::Account)
344	}
345
346	pub fn level(self) -> Level {
347	match self.as_str().rsplit_once(':').map_or("", \|(_, level)\| level) {
348	"write" => Level::Write,
349	"run" => Level::Run,
350	"delete" => Level::Delete,
351	"admin" => Level::Admin,
352	_ => Level::Read,
353	}
354	}
355
356	/// Whether holding `self` gives `other`: the same resource, at the same
357	/// level or a lower one.
358	pub fn includes(self, other: Scope) -> bool {
359	self.resource() == other.resource() && self.level() >= other.level()
360	}
361
362	/// Changes that are hard or impossible to undo, or that decide who can
363	/// reach what. Shown behind a warning wherever scopes are chosen.
364	pub fn dangerous(self) -> bool {
365	matches!(self.level(), Level::Admin \| Level::Delete)
366	}
367
368	/// What it lets a token do, in plain words.
369	pub fn describe(self) -> &'static str {
370	match self {
371	Scope::RepoRead => "See repositories, their settings, labels, timelines, releases, languages, contributors and security alerts, and search",
372	Scope::RepoWrite => "Create repositories, rename branches, change how pull requests merge and publish releases",
373	Scope::RepoAdmin => "Rename, archive, transfer, delete or change who can see a repository, change its rulesets, and dismiss security alerts",
374	Scope::CodeRead => "Clone and fetch private repositories with git",
375	Scope::CodeWrite => "Push commits with git",
376	Scope::SecurityRead => "See secret scanning, code scanning and vulnerability alerts, custom patterns, the dependency graph and SBOM, and security settings",
377	Scope::SecurityWrite => "Dismiss and reopen alerts, bypass push protection, review bypass requests, manage custom patterns, upload SARIF and change security settings",
378	Scope::PackagesRead => "Pull container images and install private packages",
379	Scope::PackagesWrite => "Push container images and publish packages",
380	Scope::PackagesDelete => "Delete and restore packages and their versions",
381	Scope::IssuesRead => "Read issues, comments and plans",
382	Scope::IssuesWrite => "Open, edit, close and comment on issues",
383	Scope::PullRequestsRead => "Read pull requests, their changes, sessions and merge queues",
384	Scope::PullRequestsWrite => "Open, review, close and merge pull requests",
385	Scope::AgentsRun => "Put g1t agents to work and message them, which uses the workspace's money",
386	Scope::WorkflowsRead => "Read workflows, runs and logs",
387	Scope::WorkflowsWrite => "Run, cancel, rerun and turn workflows on or off",
388	Scope::WorkflowFilesWrite => "Add, change and delete workflow files under .g1t/workflows and .github/workflows, with git or the API",
389	Scope::ChecksRead => "Read commits' statuses, check runs, check suites and annotations",
390	Scope::ChecksWrite => "Report statuses and check runs on commits, and ask for checks to run again",
391	Scope::DeploymentsRead => "See deployments, their statuses and environments",
392	Scope::DeploymentsWrite => "Report deployments and their statuses, from any CI",
393	Scope::MemoryRead => "Recall memory and search the workspace's context",
394	Scope::MemoryWrite => "Save memory for the next agent",
395	Scope::AccountRead => "Read your email addresses, invites, invitations, pinned projects and stars",
396	Scope::AccountWrite => "Change your email addresses, make invites, answer invitations, pin projects and star repositories",
397	Scope::NotificationsRead => "See your inbox, its threads, and what you subscribe to and watch",
398	Scope::NotificationsWrite => "Mark notifications read, done, saved or snoozed, subscribe to threads and watch repositories",
399	Scope::ChatRead => "Read the conversations you are in: channels, direct messages, threads and reactions, live",
400	Scope::ChatWrite => "Send, edit and delete your messages, react, mark conversations read, and answer cards in chat",
401	Scope::WorkspaceRead => "Read workspace settings, invites, integrations, model routes, teams and rulesets",
402	Scope::WorkspaceAdmin => "Create and delete workspaces, invite members, connect integrations, create, change and delete teams, and change the workspace's rulesets",
403	Scope::BillingRead => "See a workspace's usage, budget, AI credit and invoices",
404	Scope::BillingWrite => "Change a workspace's budget and buy AI credit",
405	Scope::AccessRead => "See who has access to repositories",
406	Scope::AccessAdmin => "Give and take away access to repositories, a team's included",
407	Scope::WebhooksRead => "See webhooks and their deliveries",
408	Scope::WebhooksAdmin => "Create, change and delete webhooks",
409	Scope::SecretsRead => "List secrets (never their values) and read variables",
410	Scope::SecretsAdmin => "Set and delete secrets and variables",
411	Scope::RunnersRead => "See self-hosted runners, their groups and where agents run",
412	Scope::RunnersAdmin => "Register and remove self-hosted runners, change their groups and settings",
413	Scope::ModelsRead => "See the workspace's AI Gateway requests: their models, tokens, cost and status",
414	Scope::ModelsWrite => "Send model requests through the AI Gateway, which uses the workspace's AI credit",
415	Scope::ArtifactsRead => "List, read and search artifacts you can see, their versions, and the numbers their dashboards show",
416	Scope::ArtifactsWrite => "Create, rename, move, edit, trash and restore artifacts, and propose changes to them",
417	Scope::ArtifactsAdmin => "Share artifacts, change who can open them, and delete them for good",
418	}
419	}
420
421	/// Whether tokens are offered it yet: its resource's [`Resource::offered`].
422	pub fn offered(self) -> bool {
423	self.resource().offered()
424	}
425	}
426
427	/// Every scope tokens are offered, in table order: what OAuth advertises.
428	pub fn offered_scopes() -> Vec<Scope> {
429	Scope::ALL.into_iter().filter(\|scope\| scope.offered()).collect()
430	}
431
432	impl Serialize for Scope {
433	fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
434	serializer.serialize_str(self.as_str())
435	}
436	}
437
438	impl<'de> Deserialize<'de> for Scope {
439	fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
440	let text = String::deserialize(deserializer)?;
441	Scope::parse(&text).ok_or_else(\|\| serde::de::Error::custom(format!("unknown scope {text}")))
442	}
443	}
444
445	/// Scopes as written in a token's row or an OAuth request: separated by
446	/// spaces or commas. Unknown names are left out, so a client asking for a
447	/// scope from a newer version gets the rest.
448	pub fn parse_scopes(text: &str) -> Vec<Scope> {
449	let mut scopes: Vec<Scope> = text
450	.split(\|c: char\| c.is_whitespace() \|\| c == ',')
451	.filter_map(Scope::parse)
452	.filter(\|scope\| scope.offered())
453	.collect();
454	normalize(&mut scopes);
455	scopes
456	}
457
458	/// In table order, without repeats.
459	pub fn normalize(scopes: &mut Vec<Scope>) {
460	let given = std::mem::take(scopes);
461	scopes.extend(Scope::ALL.into_iter().filter(\|scope\| given.contains(scope)));
462	}
463
464	/// Space-separated, as stored and as OAuth writes them.
465	pub fn scopes_text(scopes: &[Scope]) -> String {
466	scopes.iter().map(\|scope\| scope.as_str()).collect::<Vec<_>>().join(" ")
467	}
468
469	/// Where a resource sits on the token form, and which tokens may hold it.
470	#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
471	#[serde(rename_all = "snake_case")]
472	pub enum ResourceGroup {
473	/// About repositories: what they hold and how they are run.
474	Repository,
475	/// About a workspace itself.
476	Workspace,
477	/// About the person: only a personal token may hold these.
478	Account,
479	}
480
481	impl ResourceGroup {
482	pub const ALL: [ResourceGroup; 3] = [ResourceGroup::Repository, ResourceGroup::Workspace, ResourceGroup::Account];
483
484	pub fn as_str(self) -> &'static str {
485	match self {
486	ResourceGroup::Repository => "repository",
487	ResourceGroup::Workspace => "workspace",
488	ResourceGroup::Account => "account",
489	}
490	}
491	}
492
493	impl Resource {
494	pub fn group(self) -> ResourceGroup {
495	match self {
496	Resource::Account \| Resource::Notifications \| Resource::Chat => ResourceGroup::Account,
497	Resource::Workspace \| Resource::Billing \| Resource::Runners \| Resource::Models \| Resource::Artifacts => ResourceGroup::Workspace,
498	_ => ResourceGroup::Repository,
499	}
500	}
501
502	pub fn parse(text: &str) -> Option<Resource> {
503	let text = text.trim().to_ascii_lowercase();
504	Resource::ALL.into_iter().find(\|resource\| resource.as_str() == text)
505	}
506
507	/// Its scopes, least first.
508	pub fn scopes(self) -> Vec<Scope> {
509	Scope::ALL.into_iter().filter(\|scope\| scope.resource() == self).collect()
510	}
511	}
512
513	// --- Permissions --------------------------------------------------------------
514	//
515	// A token's permissions are its scopes read per resource: each resource
516	// at none or one level (`{"issues": "write", "repo": "read"}`). A level
517	// includes the ones below it, so the highest scope held of each resource
518	// says everything; that is what a token stores. Personal tokens and a
519	// workspace's own tokens are made, shown and checked this way alike.
520
521	/// The highest scope of each resource held, in table order: the fewest
522	/// scopes that give the same access, as tokens store them.
523	pub fn top_scopes(scopes: &[Scope]) -> Vec<Scope> {
524	let mut top: Vec<Scope> = Vec::new();
525	for resource in Resource::ALL {
526	if let Some(best) = scopes.iter().filter(\|scope\| scope.resource() == resource).max_by_key(\|scope\| scope.level()) {
527	top.push(*best);
528	}
529	}
530	normalize(&mut top);
531	top
532	}
533
534	/// Every resource at its highest level: all a token can be given.
535	pub fn everything() -> Vec<Scope> {
536	top_scopes(&offered_scopes())
537	}
538
539	/// Scopes as permissions: each resource held, by name, at its highest
540	/// level held.
541	pub fn permissions_of(scopes: &[Scope]) -> std::collections::BTreeMap<String, String> {
542	top_scopes(scopes)
543	.into_iter()
544	.map(\|scope\| (scope.resource().as_str().to_owned(), scope.level().as_str().to_owned()))
545	.collect()
546	}
547
548	/// Permissions as asked for (`{"issues": "write"}`, `none` or empty left
549	/// out) into the scopes a token stores, or why they cannot be. `personal`
550	/// is whether the token is a person's: only theirs may hold account ones.
551	pub fn resolve_permissions(asked: &std::collections::BTreeMap<String, String>, personal: bool) -> Result<Vec<Scope>, String> {
552	let mut scopes = Vec::new();
553	for (name, level) in asked {
554	let Some(resource) = Resource::parse(name).filter(\|resource\| resource.offered()) else {
555	return Err(format!("There is no permission called {name}."));
556	};
557	let level = level.trim().to_ascii_lowercase();
558	if level.is_empty() \|\| level == "none" {
559	continue;
560	}
561	let Some(scope) = Scope::parse(&format!("{}:{level}", resource.as_str())) else {
562	let levels: Vec<&str> = resource.scopes().iter().map(\|scope\| scope.level().as_str()).collect();
563	return Err(format!("{} is none or {}, not {level}.", resource.as_str(), levels.join(", ")));
564	};
565	if resource.group() == ResourceGroup::Account && !personal {
566	return Err(format!("{} is about a person's account: a workspace's token cannot hold it.", resource.as_str()));
567	}
568	scopes.push(scope);
569	}
570	Ok(top_scopes(&scopes))
571	}
572
573	/// What a token stores for full access, which is not a scope a client can
574	/// ask for by name.
575	pub const FULL_ACCESS: &str = "*";
576
577	/// Starting points for choosing scopes.
578	#[derive(Clone, Copy, Debug, PartialEq, Eq)]
579	pub enum Preset {
580	ReadOnly,
581	Agent,
582	Ci,
583	Full,
584	}
585
586	impl Preset {
587	pub const ALL: [Preset; 4] = [Preset::ReadOnly, Preset::Agent, Preset::Ci, Preset::Full];
588
589	pub fn as_str(self) -> &'static str {
590	match self {
591	Preset::ReadOnly => "read_only",
592	Preset::Agent => "agent",
593	Preset::Ci => "ci",
594	Preset::Full => "full",
595	}
596	}
597
598	pub fn label(self) -> &'static str {
599	match self {
600	Preset::ReadOnly => "Read only",
601	Preset::Agent => "Agent",
602	Preset::Ci => "CI",
603	Preset::Full => "Full access",
604	}
605	}
606
607	/// Its scopes; `None` for full access.
608	pub fn scopes(self) -> Option<Vec<Scope>> {
609	// Chat is not in any: a person's conversations go to an application
610	// only when it asks for them by name.
611	let reads = \|\| {
612	Scope::ALL
613	.into_iter()
614	.filter(\|scope\| scope.level() == Level::Read && scope.offered() && scope.resource() != Resource::Chat)
615	};
616	match self {
617	Preset::ReadOnly => Some(reads().collect()),
618	Preset::Agent => {
619	// Not the machines work runs on: an agent has no business
620	// knowing a workspace's own runners.
621	let mut scopes: Vec<Scope> = reads().filter(\|scope\| scope.resource() != Resource::Runners).collect();
622	// And answering what needs the person it works for: marking
623	// it done, subscribing, watching.
624	scopes.extend([
625	Scope::CodeWrite,
626	Scope::IssuesWrite,
627	Scope::PullRequestsWrite,
628	Scope::AgentsRun,
629	Scope::MemoryWrite,
630	Scope::NotificationsWrite,
631	]);
632	normalize(&mut scopes);
633	Some(scopes)
634	}
635	Preset::Ci => Some(vec![
636	Scope::RepoRead,
637	Scope::CodeRead,
638	Scope::CodeWrite,
639	Scope::PackagesRead,
640	Scope::PackagesWrite,
641	Scope::WorkflowsRead,
642	Scope::WorkflowsWrite,
643	Scope::ChecksRead,
644	Scope::ChecksWrite,
645	Scope::DeploymentsRead,
646	Scope::DeploymentsWrite,
647	]),
648	Preset::Full => None,
649	}
650	}
651	}
652
653	/// What an OAuth client gets when it asks for nothing in particular: the
654	/// agent preset. Never an admin scope.
655	pub fn oauth_default() -> Vec<Scope> {
656	Preset::Agent.scopes().unwrap_or_default()
657	}
658
659	/// Set on a [`crate::User`] resolved from an access token: what the token
660	/// may do. Absent on a signed-in session, which may do whatever its person
661	/// can.
662	#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
663	pub struct TokenAccess {
664	/// The token's id, as audit entries and errors name it.
665	#[serde(default)]
666	pub token_id: String,
667	/// Its scopes, as `resource:level`. Absent: full access, everything the
668	/// person (or workspace) can do.
669	#[serde(default, skip_serializing_if = "Option::is_none")]
670	pub scopes: Option<Vec<String>>,
671	/// Made before tokens had scopes: full access until someone narrows it.
672	#[serde(default, skip_serializing_if = "std::ops::Not::not")]
673	pub legacy: bool,
674	/// Set on a workflow job's token (`G1T_TOKEN`): the one repository it
675	/// reaches, as `owner/name`. Every other is refused, whatever its owner
676	/// could reach.
677	#[serde(default, skip_serializing_if = "Option::is_none")]
678	pub repo: Option<String>,
679	/// Set on a workflow job's token: the run and job it was made for. The
680	/// audit log records its changes as that job's, and what it changes
681	/// starts no workflows (only `workflow_dispatch` and
682	/// `repository_dispatch` do), so a workflow cannot set itself off.
683	#[serde(default, skip_serializing_if = "Option::is_none")]
684	pub job: Option<JobToken>,
685	/// The token's name, as its owner gave it, so a log can say which
686	/// token made a request. Absent where whoever resolved it did not say.
687	#[serde(default, skip_serializing_if = "Option::is_none")]
688	pub name: Option<String>,
689	/// Set on a token narrowed to less than its owner can reach: one
690	/// workspace (all, selected or none of its private repositories), or
691	/// none at all (its owner's account and public repositories). Absent
692	/// on a token that reaches every workspace its owner can.
693	///
694	/// The wire key is `fine_grained`, kept from before tokens were one
695	/// kind, so services deployed at different moments agree on it.
696	#[serde(rename = "fine_grained", default, skip_serializing_if = "Option::is_none")]
697	pub reach: Option<TokenReach>,
698	/// Set on a workspace's own token that an owner gave Admin when making
699	/// it. Without it a workspace's token has Write on the workspace's
700	/// repositories, as a member would (see [`crate::access`]).
701	#[serde(default, skip_serializing_if = "std::ops::Not::not")]
702	pub admin: bool,
703	/// Set on what a repository's deploy key resolves to: the key's id. Its
704	/// `repo` is the one repository it reaches.
705	#[serde(default, skip_serializing_if = "Option::is_none")]
706	pub deploy_key: Option<String>,
707	/// Set on a person's token whose owner let it use the website (g1t.sh)
708	/// as them, sent as `Authorization: Bearer`. Not a scope: no preset,
709	/// full access or OAuth grant includes it, and git, the API and MCP
710	/// ignore it.
711	#[serde(default, skip_serializing_if = "std::ops::Not::not")]
712	pub website: bool,
713	}
714
715	/// Which repositories a token reaches in the workspace it is made for.
716	#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
717	#[serde(rename_all = "snake_case")]
718	pub enum RepositorySelection {
719	/// Every repository of the workspace, ones made later included.
720	#[default]
721	All,
722	/// The repositories chosen, by id.
723	Selected,
724	/// None of the workspace's private repositories: public repositories,
725	/// read-only, and the workspace's own settings its permissions allow.
726	/// With no workspace: the owner's account and public repositories only.
727	Public,
728	}
729
730	impl RepositorySelection {
731	pub fn as_str(self) -> &'static str {
732	match self {
733	RepositorySelection::All => "all",
734	RepositorySelection::Selected => "selected",
735	RepositorySelection::Public => "public",
736	}
737	}
738
739	pub fn parse(text: &str) -> Option<RepositorySelection> {
740	match text.trim().to_ascii_lowercase().as_str() {
741	"all" => Some(RepositorySelection::All),
742	"selected" => Some(RepositorySelection::Selected),
743	"public" \| "public_only" \| "none" => Some(RepositorySelection::Public),
744	_ => None,
745	}
746	}
747	}
748
749	/// What a narrowed token reaches, as identity resolves it on each use.
750	#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
751	pub struct TokenReach {
752	/// The workspace whose repositories and settings it reaches, by slug as
753	/// it is now. Absent: its owner's account only, with public
754	/// repositories read-only.
755	#[serde(default, skip_serializing_if = "Option::is_none")]
756	pub workspace: Option<String>,
757	#[serde(default)]
758	pub repositories: RepositorySelection,
759	/// With [`RepositorySelection::Selected`]: the repositories' ids.
760	#[serde(default, skip_serializing_if = "Vec::is_empty")]
761	pub repo_ids: Vec<String>,
762	}
763
764	impl TokenReach {
765	/// Whether it reaches the repository with this id in the workspace
766	/// `namespace` for more than what anyone may do with a public one.
767	pub fn covers(&self, repo_id: &str, namespace: &str) -> bool {
768	let Some(workspace) = self.workspace.as_deref() else {
769	return false;
770	};
771	if !workspace.eq_ignore_ascii_case(namespace) {
772	return false;
773	}
774	match self.repositories {
775	RepositorySelection::All => true,
776	RepositorySelection::Selected => self.repo_ids.iter().any(\|id\| id == repo_id),
777	RepositorySelection::Public => false,
778	}
779	}
780
781	/// Whether it is made for the workspace `slug`.
782	pub fn owned_by(&self, slug: &str) -> bool {
783	self.workspace.as_deref().is_some_and(\|workspace\| workspace.eq_ignore_ascii_case(slug))
784	}
785	}
786
787	/// Where workflow files live. Adding, changing or deleting a file under
788	/// one, with git or through g1t, needs [`Scope::WorkflowFilesWrite`] from a
789	/// token: what GitHub's `workflow` scope and `workflows` permission do.
790	pub const WORKFLOW_DIRS: [&str; 2] = [".g1t/workflows/", ".github/workflows/"];
791
792	/// Whether `path` is a workflow file, or a file in one's directory.
793	pub fn is_workflow_file(path: &str) -> bool {
794	let path = path.trim_start_matches('/');
795	WORKFLOW_DIRS.iter().any(\|dir\| {
796	path.len() >= dir.len() && path.is_char_boundary(dir.len()) && path[..dir.len()].eq_ignore_ascii_case(dir)
797	}) \|\| WORKFLOW_DIRS.iter().any(\|dir\| path.eq_ignore_ascii_case(dir.trim_end_matches('/')))
798	}
799
800	/// Whether a token may add, change or delete the files at `paths`: a
801	/// refusal naming the first workflow file it may not touch, else `None`.
802	/// A signed-in person (no token) is never refused here; their role decides.
803	pub fn decide_workflow_files<'a>(access: Option<&TokenAccess>, paths: impl IntoIterator<Item = &'a str>) -> Option<Decision> {
804	let access = access?;
805	if access.allows(Scope::WorkflowFilesWrite) && access.job.is_none() {
806	return None;
807	}
808	let path = paths.into_iter().find(\|path\| is_workflow_file(path))?;
809	let why = if access.job.is_some() {
810	"a workflow job's token can never add or change workflow files".to_owned()
811	} else {
812	format!("it needs the {} scope", Scope::WorkflowFilesWrite.as_str())
813	};
814	Some(Decision::deny(
815	"token:workflows",
816	format!("This access token cannot change the workflow file {path}: {why}."),
817	))
818	}
819
820	/// The workflow job a token was made for.
821	#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
822	pub struct JobToken {
823	/// The run, `run_…`.
824	pub run_id: String,
825	/// The job, `job_…`.
826	pub job_id: String,
827	/// Whether it may open pull requests and approve them, by its
828	/// repository's and workspace's choice ("Allow g1t Actions to create and
829	/// approve pull requests"). Off unless chosen.
830	#[serde(default)]
831	pub pull_requests: bool,
832	}
833
834	impl TokenAccess {
835	/// Full access to everything: the access tokens made before scopes had.
836	pub fn full() -> Self {
837	TokenAccess::default()
838	}
839
840	/// Whether it may reach the repository `owner/name`: every token but a
841	/// workflow job's, which reaches its own repository only.
842	pub fn reaches(&self, repo: &str) -> bool {
843	self.repo.as_deref().is_none_or(\|only\| only.eq_ignore_ascii_case(repo))
844	}
845
846	pub fn is_full(&self) -> bool {
847	self.scopes.is_none()
848	}
849
850	/// The scopes it holds, or `None` for full access.
851	pub fn granted(&self) -> Option<Vec<Scope>> {
852	self.scopes
853	.as_ref()
854	.map(\|scopes\| scopes.iter().filter_map(\|scope\| Scope::parse(scope)).collect())
855	}
856
857	pub fn allows(&self, needed: Scope) -> bool {
858	match self.granted() {
859	None => true,
860	Some(granted) => granted.iter().any(\|held\| held.includes(needed)),
861	}
862	}
863
864	/// Whether it reaches the repository with this id in `namespace` for
865	/// more than reading a public one: every token but a narrowed one
866	/// outside its workspace or repository selection. Its owner's role
867	/// still decides; see [`crate::access`].
868	pub fn covers_repo(&self, repo_id: &str, namespace: &str) -> bool {
869	self.reach.as_ref().is_none_or(\|reach\| reach.covers(repo_id, namespace))
870	}
871	}
872
873	/// Every operation of the API and MCP server, with the scope it needs. An
874	/// operation in [`NO_SCOPE`] needs none. The API checks that every one of
875	/// its operations is in exactly one of the two.
876	pub const OPERATIONS: &[(&str, Scope)] = &[
877	// Your account.
878	("list_emails", Scope::AccountRead),
879	("add_email", Scope::AccountWrite),
880	("confirm_email", Scope::AccountWrite),
881	("remove_email", Scope::AccountWrite),
882	("update_email_settings", Scope::AccountWrite),
883	("list_invites", Scope::AccountRead),
884	("create_invite", Scope::AccountWrite),
885	("revoke_invite", Scope::AccountWrite),
886	("list_invitations", Scope::AccountRead),
887	("accept_invitation", Scope::AccountWrite),
888	("decline_invitation", Scope::AccountWrite),
889	("list_my_repo_invitations", Scope::AccountRead),
890	("accept_repo_invitation", Scope::AccountWrite),
891	("decline_repo_invitation", Scope::AccountWrite),
892	// Your pinned projects: a preference of your account.
893	("list_pinned_projects", Scope::AccountRead),
894	("pin_project", Scope::AccountWrite),
895	// Your stars: a preference of your account.
896	("list_starred", Scope::AccountRead),
897	("check_starred", Scope::AccountRead),
898	("star_repo", Scope::AccountWrite),
899	("unstar_repo", Scope::AccountWrite),
900	("unpin_project", Scope::AccountWrite),
901	("reorder_pinned_projects", Scope::AccountWrite),
902	// Your inbox: notifications, subscriptions and watching.
903	("list_notifications", Scope::NotificationsRead),
904	("get_notification_thread", Scope::NotificationsRead),
905	("get_thread_subscription", Scope::NotificationsRead),
906	("get_repo_subscription", Scope::NotificationsRead),
907	("list_watched_repos", Scope::NotificationsRead),
908	("mark_notifications_read", Scope::NotificationsWrite),
909	("mark_thread_read", Scope::NotificationsWrite),
910	("mark_thread_done", Scope::NotificationsWrite),
911	("save_thread", Scope::NotificationsWrite),
912	("snooze_thread", Scope::NotificationsWrite),
913	("set_thread_subscription", Scope::NotificationsWrite),
914	("delete_thread_subscription", Scope::NotificationsWrite),
915	("set_repo_subscription", Scope::NotificationsWrite),
916	("delete_repo_subscription", Scope::NotificationsWrite),
917	// Workspaces, their invites and integrations.
918	("create_workspace", Scope::WorkspaceAdmin),
919	("delete_workspace", Scope::WorkspaceAdmin),
920	("get_workspace", Scope::WorkspaceRead),
921	("update_workspace", Scope::WorkspaceAdmin),
922	// Its members, and who owns it.
923	("list_members", Scope::WorkspaceRead),
924	("update_member", Scope::WorkspaceAdmin),
925	("remove_member", Scope::WorkspaceAdmin),
926	("transfer_ownership", Scope::WorkspaceAdmin),
927	("leave_workspace", Scope::AccountWrite),
928	("list_workspace_invites", Scope::WorkspaceRead),
929	("invite_member", Scope::WorkspaceAdmin),
930	("revoke_workspace_invite", Scope::WorkspaceAdmin),
931	("list_integrations", Scope::WorkspaceRead),
932	("connect_integration", Scope::WorkspaceAdmin),
933	("update_integration", Scope::WorkspaceAdmin),
934	("disconnect_integration", Scope::WorkspaceAdmin),
935	("test_integration", Scope::WorkspaceAdmin),
936	("get_model_routes", Scope::WorkspaceRead),
937	("set_model_routes", Scope::WorkspaceAdmin),
938	// Customize: the marketplaces a workspace reads, the plugins it installs
939	// and the connectors it signs in. Members see them, owners change them,
940	// and a job's agent token reads the bundle its Claude Code loads.
941	("list_marketplaces", Scope::WorkspaceRead),
942	("add_marketplace", Scope::WorkspaceAdmin),
943	("remove_marketplace", Scope::WorkspaceAdmin),
944	("refresh_marketplace", Scope::WorkspaceAdmin),
945	("discover", Scope::WorkspaceRead),
946	("list_plugins", Scope::WorkspaceRead),
947	("get_plugin", Scope::WorkspaceRead),
948	("install_plugin", Scope::WorkspaceAdmin),
949	("set_plugin_enabled", Scope::WorkspaceAdmin),
950	("uninstall_plugin", Scope::WorkspaceAdmin),
951	("update_plugin", Scope::WorkspaceAdmin),
952	("list_plugin_agents", Scope::WorkspaceRead),
953	("list_connectors", Scope::WorkspaceRead),
954	("get_connector", Scope::WorkspaceRead),
955	("add_connector", Scope::WorkspaceAdmin),
956	("set_connector_key", Scope::WorkspaceAdmin),
957	("remove_connector", Scope::WorkspaceAdmin),
958	("refresh_connector", Scope::WorkspaceAdmin),
959	("grant_connector", Scope::WorkspaceAdmin),
960	("revoke_connector", Scope::WorkspaceAdmin),
961	("customize_bundle", Scope::AgentsRun),
962	// Teams: reading them, and managing them. A team's role on a
963	// repository is who has access.
964	("list_teams", Scope::WorkspaceRead),
965	("get_team", Scope::WorkspaceRead),
966	("list_team_members", Scope::WorkspaceRead),
967	("list_child_teams", Scope::WorkspaceRead),
968	("list_team_repos", Scope::WorkspaceRead),
969	("list_user_teams", Scope::WorkspaceRead),
970	("create_team", Scope::WorkspaceAdmin),
971	("list_workspace_rulesets", Scope::WorkspaceRead),
972	("get_workspace_ruleset", Scope::WorkspaceRead),
973	("list_workspace_rule_evaluations", Scope::WorkspaceRead),
974	("create_workspace_ruleset", Scope::WorkspaceAdmin),
975	("update_workspace_ruleset", Scope::WorkspaceAdmin),
976	("delete_workspace_ruleset", Scope::WorkspaceAdmin),
977	("update_team", Scope::WorkspaceAdmin),
978	("delete_team", Scope::WorkspaceAdmin),
979	("set_team_member", Scope::WorkspaceAdmin),
980	("remove_team_member", Scope::WorkspaceAdmin),
981	("set_team_review_assignment", Scope::WorkspaceAdmin),
982	// A workspace's billing: usage, budget, AI credit and invoices.
983	("get_usage", Scope::BillingRead),
984	("get_budget", Scope::BillingRead),
985	("get_ai_credit", Scope::BillingRead),
986	("list_invoices", Scope::BillingRead),
987	("get_billing_details", Scope::BillingRead),
988	("set_budget", Scope::BillingWrite),
989	("buy_ai_credit", Scope::BillingWrite),
990	// Repositories.
991	("list_repos", Scope::RepoRead),
992	("get_repo", Scope::RepoRead),
993	// Projects follow their repositories.
994	("list_projects", Scope::RepoRead),
995	("get_project", Scope::RepoRead),
996	("search", Scope::RepoRead),
997	("list_events", Scope::RepoRead),
998	// What the default branch says about a repository, who starred it, and
999	// its releases.
1000	("get_languages", Scope::RepoRead),
1001	("list_contributors", Scope::RepoRead),
1002	("get_license", Scope::RepoRead),
1003	("list_stargazers", Scope::RepoRead),
1004	("list_releases", Scope::RepoRead),
1005	("get_latest_release", Scope::RepoRead),
1006	("get_release_by_tag", Scope::RepoRead),
1007	("get_release", Scope::RepoRead),
1008	("create_release", Scope::RepoWrite),
1009	("update_release", Scope::RepoWrite),
1010	("delete_release", Scope::RepoWrite),
1011	("list_labels", Scope::RepoRead),
1012	("list_milestones", Scope::RepoRead),
1013	("get_milestone", Scope::RepoRead),
1014	("create_label", Scope::IssuesWrite),
1015	("update_label", Scope::IssuesWrite),
1016	("delete_label", Scope::IssuesWrite),
1017	("add_default_labels", Scope::IssuesWrite),
1018	("create_milestone", Scope::IssuesWrite),
1019	("update_milestone", Scope::IssuesWrite),
1020	("delete_milestone", Scope::IssuesWrite),
1021	("get_repo_settings", Scope::RepoRead),
1022	("list_check_names", Scope::RepoRead),
1023	("list_deleted_repos", Scope::RepoRead),
1024	("list_security_alerts", Scope::RepoRead),
1025	("get_codeowners_errors", Scope::RepoRead),
1026	("create_repo", Scope::RepoWrite),
1027	("update_repo", Scope::RepoWrite),
1028	("update_project", Scope::RepoWrite),
1029	("update_repo_settings", Scope::RepoWrite),
1030	// Rulesets: reading them is reading the repository; changing them
1031	// changes what everyone, agents included, may do, so it is admin.
1032	("list_repo_rulesets", Scope::RepoRead),
1033	("get_repo_ruleset", Scope::RepoRead),
1034	("get_branch_rules", Scope::RepoRead),
1035	("list_rule_evaluations", Scope::RepoRead),
1036	("create_repo_ruleset", Scope::RepoAdmin),
1037	("update_repo_ruleset", Scope::RepoAdmin),
1038	("delete_repo_ruleset", Scope::RepoAdmin),
1039	("rename_branch", Scope::RepoWrite),
1040	("rename_repo", Scope::RepoAdmin),
1041	("transfer_repo", Scope::RepoAdmin),
1042	("archive_repo", Scope::RepoAdmin),
1043	("unarchive_repo", Scope::RepoAdmin),
1044	("set_repo_visibility", Scope::RepoAdmin),
1045	("delete_repo", Scope::RepoAdmin),
1046	("restore_repo", Scope::RepoAdmin),
1047	("purge_repo", Scope::RepoAdmin),
1048	// A dismissed secret is let through push protection.
1049	("dismiss_security_alert", Scope::RepoAdmin),
1050	("reopen_security_alert", Scope::RepoAdmin),
1051	// The security suite: alerts, push protection, patterns, code
1052	// scanning, the supply chain and settings.
1053	("list_secret_scanning_alerts", Scope::SecurityRead),
1054	("get_secret_scanning_alert", Scope::SecurityRead),
1055	("list_secret_scanning_locations", Scope::SecurityRead),
1056	("list_bypass_requests", Scope::SecurityRead),
1057	("list_custom_patterns", Scope::SecurityRead),
1058	("list_code_scanning_alerts", Scope::SecurityRead),
1059	("get_code_scanning_alert", Scope::SecurityRead),
1060	("list_code_scanning_analyses", Scope::SecurityRead),
1061	("get_sarif_upload", Scope::SecurityRead),
1062	("list_vulnerability_alerts", Scope::SecurityRead),
1063	("get_vulnerability_alert", Scope::SecurityRead),
1064	("get_dependency_graph", Scope::SecurityRead),
1065	("get_sbom", Scope::SecurityRead),
1066	("compare_dependencies", Scope::SecurityRead),
1067	("get_security_settings", Scope::SecurityRead),
1068	("get_workspace_security_settings", Scope::SecurityRead),
1069	("get_security_overview", Scope::SecurityRead),
1070	("list_security_advisories", Scope::SecurityRead),
1071	("get_security_advisory", Scope::SecurityRead),
1072	("list_vulnerability_reports", Scope::SecurityRead),
1073	("update_secret_scanning_alert", Scope::SecurityWrite),
1074	("bypass_push_protection", Scope::SecurityWrite),
1075	("check_secret_validity", Scope::SecurityWrite),
1076	("review_bypass_request", Scope::SecurityWrite),
1077	("create_custom_pattern", Scope::SecurityWrite),
1078	("update_custom_pattern", Scope::SecurityWrite),
1079	("delete_custom_pattern", Scope::SecurityWrite),
1080	("dry_run_custom_pattern", Scope::SecurityWrite),
1081	("update_code_scanning_alert", Scope::SecurityWrite),
1082	("upload_sarif", Scope::SecurityWrite),
1083	("update_vulnerability_alert", Scope::SecurityWrite),
1084	("fix_security_alert", Scope::SecurityWrite),
1085	("update_security_settings", Scope::SecurityWrite),
1086	("update_workspace_security_settings", Scope::SecurityWrite),
1087	("create_security_advisory", Scope::SecurityWrite),
1088	("update_security_advisory", Scope::SecurityWrite),
1089	("set_security_advisory_state", Scope::SecurityWrite),
1090	("report_vulnerability", Scope::SecurityWrite),
1091	("review_vulnerability_report", Scope::SecurityWrite),
1092	// Issues and plans.
1093	("list_issues", Scope::IssuesRead),
1094	("get_issue", Scope::IssuesRead),
1095	("get_plan", Scope::IssuesRead),
1096	("create_issue", Scope::IssuesWrite),
1097	("update_issue", Scope::IssuesWrite),
1098	("list_issue_labels", Scope::IssuesRead),
1099	("add_issue_labels", Scope::IssuesWrite),
1100	("set_issue_labels", Scope::IssuesWrite),
1101	("remove_issue_labels", Scope::IssuesWrite),
1102	("close_issue", Scope::IssuesWrite),
1103	("reopen_issue", Scope::IssuesWrite),
1104	("add_comment", Scope::IssuesWrite),
1105	("edit_comment", Scope::IssuesWrite),
1106	("delete_comment", Scope::IssuesWrite),
1107	("import_issue", Scope::IssuesWrite),
1108	("apply_plan", Scope::IssuesWrite),
1109	// Pull requests.
1110	("list_pull_requests", Scope::PullRequestsRead),
1111	("get_pull_request", Scope::PullRequestsRead),
1112	("get_pull_request_changes", Scope::PullRequestsRead),
1113	("read_session", Scope::PullRequestsRead),
1114	("get_merge_queue", Scope::PullRequestsRead),
1115	("create_pull_request", Scope::PullRequestsWrite),
1116	("update_pull_request", Scope::PullRequestsWrite),
1117	("record_session", Scope::PullRequestsWrite),
1118	("mark_pull_request_ready", Scope::PullRequestsWrite),
1119	("close_pull_request", Scope::PullRequestsWrite),
1120	("reopen_pull_request", Scope::PullRequestsWrite),
1121	("convert_pull_request_to_draft", Scope::PullRequestsWrite),
1122	("review_pull_request", Scope::PullRequestsWrite),
1123	("merge_pull_request", Scope::PullRequestsWrite),
1124	("request_reviewers", Scope::PullRequestsWrite),
1125	("remove_requested_reviewers", Scope::PullRequestsWrite),
1126	// g1t's agents.
1127	("assign_issue", Scope::AgentsRun),
1128	("delegate", Scope::AgentsRun),
1129	("plan_work", Scope::AgentsRun),
1130	("message_agent", Scope::AgentsRun),
1131	("answer_message", Scope::AgentsRun),
1132	// A workspace agent's own computer: waking it spends the workspace's
1133	// money, so the same scope covers reading and managing it.
1134	("get_agent_computer", Scope::AgentsRun),
1135	("wake_agent_computer", Scope::AgentsRun),
1136	("sleep_agent_computer", Scope::AgentsRun),
1137	("reset_agent_computer", Scope::AgentsRun),
1138	("list_agent_computer_commands", Scope::AgentsRun),
1139	("take_messages", Scope::AgentsRun),
1140	// Workflows.
1141	("list_workflows", Scope::WorkflowsRead),
1142	("list_workflow_runs", Scope::WorkflowsRead),
1143	("get_workflow_run", Scope::WorkflowsRead),
1144	("get_job_logs", Scope::WorkflowsRead),
1145	("dispatch_workflow", Scope::WorkflowsWrite),
1146	("cancel_workflow_run", Scope::WorkflowsWrite),
1147	("rerun_workflow_run", Scope::WorkflowsWrite),
1148	("update_workflow", Scope::WorkflowsWrite),
1149	("list_artifacts", Scope::WorkflowsRead),
1150	("list_workflow_run_artifacts", Scope::WorkflowsRead),
1151	("get_artifact", Scope::WorkflowsRead),
1152	("download_artifact", Scope::WorkflowsRead),
1153	("get_artifact_retention", Scope::WorkflowsRead),
1154	("delete_artifact", Scope::WorkflowsWrite),
1155	("set_artifact_retention", Scope::WorkflowsWrite),
1156	// Checks: statuses, check runs and check suites on commits.
1157	("list_commit_statuses", Scope::ChecksRead),
1158	("get_combined_status", Scope::ChecksRead),
1159	("list_check_runs_for_ref", Scope::ChecksRead),
1160	("get_check_run", Scope::ChecksRead),
1161	("list_check_run_annotations", Scope::ChecksRead),
1162	("list_check_suites_for_ref", Scope::ChecksRead),
1163	("get_check_suite", Scope::ChecksRead),
1164	("create_commit_status", Scope::ChecksWrite),
1165	("create_check_run", Scope::ChecksWrite),
1166	("update_check_run", Scope::ChecksWrite),
1167	("rerequest_check_run", Scope::ChecksWrite),
1168	("rerequest_check_suite", Scope::ChecksWrite),
1169	// Deployments, wherever they run: reading them, and reporting them.
1170	("list_deployments", Scope::DeploymentsRead),
1171	("get_deployment", Scope::DeploymentsRead),
1172	("list_deployment_statuses", Scope::DeploymentsRead),
1173	("list_environments", Scope::DeploymentsRead),
1174	("get_environment", Scope::DeploymentsRead),
1175	("create_deployment", Scope::DeploymentsWrite),
1176	("create_deployment_status", Scope::DeploymentsWrite),
1177	("start_deployment_build", Scope::DeploymentsWrite),
1178	// What keeps runs safe: the runs environments hold and reviewing them,
1179	// approving a pull request's run, and a repository's own rules for
1180	// its environments and tokens, which are an admin's.
1181	("get_pending_deployments", Scope::WorkflowsRead),
1182	("review_pending_deployments", Scope::WorkflowsWrite),
1183	("approve_workflow_run", Scope::WorkflowsWrite),
1184	("get_workflow_permissions", Scope::RepoRead),
1185	("get_fork_pr_approval", Scope::RepoRead),
1186	("get_actions_access", Scope::RepoRead),
1187	("update_environment", Scope::RepoAdmin),
1188	("delete_environment", Scope::RepoAdmin),
1189	("set_workflow_permissions", Scope::RepoAdmin),
1190	("set_fork_pr_approval", Scope::RepoAdmin),
1191	("set_actions_access", Scope::RepoAdmin),
1192	// Starting workflows from outside, as a push would.
1193	("create_repository_dispatch", Scope::CodeWrite),
1194	// A workspace's policy for its repositories' tokens.
1195	("get_workspace_workflow_permissions", Scope::WorkspaceRead),
1196	("set_workspace_workflow_permissions", Scope::WorkspaceAdmin),
1197	// A workspace's rules for personal access tokens, and the members'
1198	// tokens that reach it: who has access.
1199	("get_token_policy", Scope::WorkspaceRead),
1200	("set_token_policy", Scope::WorkspaceAdmin),
1201	("list_member_tokens", Scope::AccessRead),
1202	("list_token_requests", Scope::AccessRead),
1203	("review_token_request", Scope::AccessAdmin),
1204	("revoke_member_token", Scope::AccessAdmin),
1205	// Memory and the context hub.
1206	("recall", Scope::MemoryRead),
1207	("search_context", Scope::MemoryRead),
1208	("get_entity", Scope::MemoryRead),
1209	("get_context", Scope::MemoryRead),
1210	("remember", Scope::MemoryWrite),
1211	// Who has access.
1212	("list_collaborators", Scope::AccessRead),
1213	("get_collaborator_permission", Scope::AccessRead),
1214	("list_repo_invitations", Scope::AccessRead),
1215	("list_outside_collaborators", Scope::AccessRead),
1216	("add_collaborator", Scope::AccessAdmin),
1217	("update_collaborator", Scope::AccessAdmin),
1218	("remove_collaborator", Scope::AccessAdmin),
1219	("revoke_repo_invitation", Scope::AccessAdmin),
1220	("set_base_permission", Scope::AccessAdmin),
1221	("set_team_repo", Scope::AccessAdmin),
1222	("remove_team_repo", Scope::AccessAdmin),
1223	// Deploy keys: each lets a machine reach one repository, so they
1224	// are part of who has access.
1225	("list_deploy_keys", Scope::AccessRead),
1226	("get_deploy_key", Scope::AccessRead),
1227	("create_deploy_key", Scope::AccessAdmin),
1228	("delete_deploy_key", Scope::AccessAdmin),
1229	// Mirroring: a repository's links to other hosts. Reading them is
1230	// reading the repository; syncing writes code; the rest is an admin's.
1231	("get_mirror", Scope::RepoRead),
1232	("sync_mirror", Scope::CodeWrite),
1233	("get_hand_back_plan", Scope::RepoAdmin),
1234	("take_over_mirror", Scope::RepoAdmin),
1235	("set_ci_failover", Scope::RepoAdmin),
1236	("hand_back_mirror", Scope::RepoAdmin),
1237	("move_mirror_to_g1t", Scope::RepoAdmin),
1238	("add_mirror_remote", Scope::RepoAdmin),
1239	("update_mirror_remote", Scope::RepoAdmin),
1240	("remove_mirror_remote", Scope::RepoAdmin),
1241	// Webhooks.
1242	("list_webhooks", Scope::WebhooksRead),
1243	("list_webhook_deliveries", Scope::WebhooksRead),
1244	("create_webhook", Scope::WebhooksAdmin),
1245	("update_webhook", Scope::WebhooksAdmin),
1246	("delete_webhook", Scope::WebhooksAdmin),
1247	("ping_webhook", Scope::WebhooksAdmin),
1248	("redeliver_webhook", Scope::WebhooksAdmin),
1249	// Secrets and variables.
1250	("list_actions_secrets", Scope::SecretsRead),
1251	("list_actions_variables", Scope::SecretsRead),
1252	("set_actions_secret", Scope::SecretsAdmin),
1253	("delete_actions_secret", Scope::SecretsAdmin),
1254	("set_actions_variable", Scope::SecretsAdmin),
1255	("delete_actions_variable", Scope::SecretsAdmin),
1256	// Self-hosted runners.
1257	("list_runners", Scope::RunnersRead),
1258	("list_runner_groups", Scope::RunnersRead),
1259	("get_runner_settings", Scope::RunnersRead),
1260	("create_runner_registration_token", Scope::RunnersAdmin),
1261	("remove_runner", Scope::RunnersAdmin),
1262	("create_runner_group", Scope::RunnersAdmin),
1263	("update_runner_group", Scope::RunnersAdmin),
1264	("delete_runner_group", Scope::RunnersAdmin),
1265	("update_runner_settings", Scope::RunnersAdmin),
1266	// Packages: reading them, their versions and who may use them needs
1267	// `packages:read`; changing their settings, access and Manage Actions
1268	// access `packages:write` (and the Admin role on the package, which the
1269	// packages service checks); deleting and restoring packages and
1270	// versions `packages:delete`, as the registries' own deletes do.
1271	("list_packages", Scope::PackagesRead),
1272	("get_package", Scope::PackagesRead),
1273	("list_package_versions", Scope::PackagesRead),
1274	("get_package_version", Scope::PackagesRead),
1275	("list_package_access", Scope::PackagesRead),
1276	("list_package_actions_access", Scope::PackagesRead),
1277	("update_package", Scope::PackagesWrite),
1278	("link_package", Scope::PackagesWrite),
1279	("unlink_package", Scope::PackagesWrite),
1280	("set_package_access", Scope::PackagesWrite),
1281	("remove_package_access", Scope::PackagesWrite),
1282	("set_package_actions_access", Scope::PackagesWrite),
1283	("remove_package_actions_access", Scope::PackagesWrite),
1284	("delete_package", Scope::PackagesDelete),
1285	("restore_package", Scope::PackagesDelete),
1286	("delete_package_version", Scope::PackagesDelete),
1287	("restore_package_version", Scope::PackagesDelete),
1288	// The AI Gateway. Sending a request to a model needs `models:write`,
1289	// checked by the model proxy at models.g1t.sh, not here.
1290	("list_gateway_requests", Scope::ModelsRead),
1291	// Artifacts mode's docs, slides, designs and dashboards (the `artifact`
1292	// MCP tool). Reading takes artifacts:read, making and changing them
1293	// artifacts:write, and sharing them or deleting them for good
1294	// artifacts:admin. The artifacts service then checks the person's own role
1295	// on each one.
1296	("list_workspace_artifacts", Scope::ArtifactsRead),
1297	("search_workspace_artifacts", Scope::ArtifactsRead),
1298	("get_workspace_artifact", Scope::ArtifactsRead),
1299	("get_workspace_artifact_content", Scope::ArtifactsRead),
1300	("list_workspace_artifact_versions", Scope::ArtifactsRead),
1301	("get_workspace_artifact_access", Scope::ArtifactsRead),
1302	("list_workspace_artifact_templates", Scope::ArtifactsRead),
1303	("list_workspace_artifact_spaces", Scope::ArtifactsRead),
1304	("query_workspace_dataset", Scope::ArtifactsRead),
1305	("create_workspace_artifact", Scope::ArtifactsWrite),
1306	("update_workspace_artifact", Scope::ArtifactsWrite),
1307	("edit_workspace_artifact", Scope::ArtifactsWrite),
1308	("trash_workspace_artifact", Scope::ArtifactsWrite),
1309	("restore_workspace_artifact", Scope::ArtifactsWrite),
1310	("restore_workspace_artifact_version", Scope::ArtifactsWrite),
1311	("set_workspace_artifact_access", Scope::ArtifactsAdmin),
1312	("purge_workspace_artifact", Scope::ArtifactsAdmin),
1313	];
1314
1315	/// Operations any token may use: saying who it is.
1316	pub const NO_SCOPE: &[&str] = &["whoami"];
1317
1318	/// The scope `operation` needs. `None` for one in [`NO_SCOPE`]; an
1319	/// operation in neither list needs full access.
1320	pub fn scope_for(operation: &str) -> Option<Scope> {
1321	OPERATIONS
1322	.iter()
1323	.find(\|(name, _)\| *name == operation)
1324	.map(\|(_, scope)\| *scope)
1325	}
1326
1327	/// What a token needs for `operation` with this input beyond its own
1328	/// scope: starting agents from an operation that can, and making a
1329	/// repository public or private.
1330	pub fn extra_scopes(operation: &str, input: &serde_json::Value) -> Vec<Scope> {
1331	let mut extra = Vec::new();
1332	let assigns = input["assign"].as_bool() == Some(true)
1333	\|\| input["agent"].as_bool() == Some(true)
1334	\|\| input["assign_agent"].as_bool() == Some(true);
1335	if assigns && matches!(operation, "apply_plan" \| "import_issue" \| "create_issue") {
1336	extra.push(Scope::AgentsRun);
1337	}
1338	// Fixing an alert opens an issue and puts g1t on it.
1339	if operation == "fix_security_alert" {
1340	extra.extend([Scope::IssuesWrite, Scope::AgentsRun]);
1341	}
1342	// Opening the issue an agent is put on.
1343	if operation == "delegate" {
1344	extra.push(Scope::IssuesWrite);
1345	}
1346	// A workspace's base permission is who has access.
1347	if operation == "update_workspace" && input.get("base_permission").is_some_and(\|v\| !v.is_null()) {
1348	extra.push(Scope::AccessAdmin);
1349	}
1350	// Asking a g1t Actions job or run to run again reruns its workflow.
1351	if matches!(operation, "rerequest_check_run" \| "rerequest_check_suite")
1352	&& input["id"].as_str().is_some_and(\|id\| id.starts_with("job_") \|\| id.starts_with("run_"))
1353	{
1354	extra.push(Scope::WorkflowsWrite);
1355	}
1356	if operation == "update_repo" && (input.get("private").is_some_and(\|v\| !v.is_null()) \|\| input.get("default_branch").is_some_and(\|v\| !v.is_null())) {
1357	extra.push(Scope::RepoAdmin);
1358	}
1359	extra
1360	}
1361
1362	/// The scopes a call needs, its own first.
1363	pub fn needed(operation: &str, input: &serde_json::Value) -> Vec<Scope> {
1364	scope_for(operation)
1365	.into_iter()
1366	.chain(extra_scopes(operation, input))
1367	.collect()
1368	}
1369
1370	/// Whether `access` may use `operation` with `input`. The person's (or
1371	/// workspace's) role is checked after this, by the service that owns what
1372	/// was asked about.
1373	pub fn decide(access: &TokenAccess, operation: &str, input: &serde_json::Value) -> Decision {
1374	let rule = if access.legacy { "token:legacy" } else { "token:scope" };
1375	// A workflow job may open or approve pull requests only where its
1376	// repository and workspace let it, as on GitHub.
1377	if let Some(job) = &access.job
1378	&& !job.pull_requests
1379	&& (operation == "create_pull_request" \|\| (operation == "review_pull_request" && input["verdict"].as_str() == Some("approve")))
1380	{
1381	return Decision::deny(
1382	"token:pull-requests",
1383	"A workflow job cannot open or approve pull requests here: an admin can allow it under Settings, Actions.",
1384	);
1385	}
1386	if let Some(only) = access.repo.as_deref()
1387	&& !NO_SCOPE.contains(&operation)
1388	{
1389	match input["repo"].as_str() {
1390	Some(repo) if access.reaches(repo) => {}
1391	Some(repo) => {
1392	return Decision::deny("token:repository", format!("This token is a workflow job's in {only}: it cannot reach {repo}."));
1393	}
1394	None => {
1395	return Decision::deny("token:repository", format!("This token is a workflow job's: it reaches only {only}, and {operation} is not about one repository."));
1396	}
1397	}
1398	}
1399	// A token made for one workspace (or none) only reads outside it:
1400	// public repositories, as anyone may. Inside it, its repository
1401	// selection is checked with its owner's role (`access::granted`).
1402	if let Some(reach) = &access.reach
1403	&& let Some(repo) = input["repo"].as_str()
1404	&& !NO_SCOPE.contains(&operation)
1405	{
1406	let namespace = repo.split('/').next().unwrap_or_default();
1407	let changes = needed(operation, input).iter().any(\|scope\| scope.level() != Level::Read);
1408	if changes && !reach.owned_by(namespace) {
1409	let made_for = reach.workspace.as_deref().map_or_else(\|\| "your account only".to_owned(), \|workspace\| format!("the workspace {workspace}"));
1410	return Decision::deny(
1411	"token:resource-owner",
1412	format!("This access token is made for {made_for}: elsewhere it can only read public repositories, and {repo} is not in its reach."),
1413	);
1414	}
1415	}
1416	if access.scopes.is_some() {
1417	let known = NO_SCOPE.contains(&operation) \|\| scope_for(operation).is_some();
1418	if !known {
1419	return Decision::deny("token:scope", format!("This access token cannot use {operation}: it needs full access."));
1420	}
1421	if let Some(missing) = needed(operation, input).into_iter().find(\|scope\| !access.allows(*scope)) {
1422	return Decision::deny(
1423	"token:scope",
1424	format!("This access token needs the {} scope to use {operation}.", missing.as_str()),
1425	);
1426	}
1427	}
1428	Decision::allow(rule)
1429	}
1430
1431	/// Whether a token may use the repository `owner/name` at all: a refusal
1432	/// for a workflow job's token or a deploy key in another repository,
1433	/// else `None`. Git and
1434	/// the package registries ask this before [`decide_git`] and
1435	/// [`decide_packages`].
1436	pub fn decide_repo(access: &TokenAccess, repo: &str) -> Option<Decision> {
1437	let only = access.repo.as_deref()?;
1438	let why = if access.deploy_key.is_some() {
1439	format!("This deploy key is for {only}: it cannot reach {repo}.")
1440	} else {
1441	format!("This token is a workflow job's in {only}: it cannot reach {repo}.")
1442	};
1443	(!access.reaches(repo)).then(\|\| Decision::deny("token:repository", why))
1444	}
1445
1446	/// Whether a token may clone or fetch (`write` false), or push to (`write`
1447	/// true), a repository with git. `public` is whether anyone may read it,
1448	/// which needs no scope.
1449	pub fn decide_git(access: &TokenAccess, write: bool, public: bool) -> Decision {
1450	let needed = if write { Scope::CodeWrite } else { Scope::CodeRead };
1451	if !access.allows(needed) && (write \|\| !public) {
1452	if access.deploy_key.is_some() {
1453	return Decision::deny(
1454	"token:scope",
1455	"This deploy key is read-only. An admin of the repository can add it again with write access to push with it.",
1456	);
1457	}
1458	return Decision::deny(
1459	"token:scope",
1460	format!("This access token needs the {} scope to {} with git.", needed.as_str(), if write { "push" } else { "clone or fetch a private repository" }),
1461	);
1462	}
1463	Decision::allow(if access.legacy { "token:legacy" } else { "token:scope" })
1464	}
1465
1466	/// Whether a token may pull (`Level::Read`), push or publish
1467	/// (`Level::Write`), or delete (`Level::Delete`) packages. `public` is
1468	/// whether anyone may pull the package, which needs no scope.
1469	pub fn decide_packages(access: &TokenAccess, level: Level, public: bool) -> Decision {
1470	let (needed, doing) = match level {
1471	Level::Read => (Scope::PackagesRead, "pull a private package"),
1472	Level::Delete \| Level::Admin => (Scope::PackagesDelete, "delete packages"),
1473	Level::Write \| Level::Run => (Scope::PackagesWrite, "push or publish packages"),
1474	};
1475	if !access.allows(needed) && !(level == Level::Read && public) {
1476	return Decision::deny(
1477	"token:scope",
1478	format!("This access token needs the {} scope to {doing}.", needed.as_str()),
1479	);
1480	}
1481	Decision::allow(if access.legacy { "token:legacy" } else { "token:scope" })
1482	}
1483
1484	#[cfg(test)]
1485	mod tests {
1486	use super::*;
1487	use serde_json::json;
1488
1489	fn token(scopes: &[Scope]) -> TokenAccess {
1490	TokenAccess {
1491	token_id: "tok_1".to_owned(),
1492	scopes: Some(scopes.iter().map(\|scope\| scope.as_str().to_owned()).collect()),
1493	legacy: false,
1494	name: None,
1495	..TokenAccess::default()
1496	}
1497	}
1498
1499	#[test]
1500	fn every_scope_reads_back_and_belongs_to_a_resource() {
1501	for scope in Scope::ALL {
1502	assert_eq!(Scope::parse(scope.as_str()), Some(scope));
1503	assert!(scope.as_str().starts_with(scope.resource().as_str()));
1504	assert!(scope.includes(scope));
1505	}
1506	assert_eq!(Scope::parse(" Issues:Write "), Some(Scope::IssuesWrite));
1507	assert_eq!(Scope::parse("issues"), None);
1508	}
1509
1510	#[test]
1511	fn a_higher_level_includes_the_lower_ones_of_its_resource_only() {
1512	assert!(Scope::RepoAdmin.includes(Scope::RepoRead));
1513	assert!(Scope::RepoAdmin.includes(Scope::RepoWrite));
1514	assert!(Scope::IssuesWrite.includes(Scope::IssuesRead));
1515	assert!(!Scope::IssuesRead.includes(Scope::IssuesWrite));
1516	assert!(!Scope::RepoAdmin.includes(Scope::CodeWrite));
1517	assert!(!Scope::PullRequestsWrite.includes(Scope::IssuesWrite));
1518	}
1519
1520	#[test]
1521	fn operations_are_listed_once_and_never_also_free() {
1522	let mut seen = std::collections::HashSet::new();
1523	for (name, _) in OPERATIONS {
1524	assert!(seen.insert(*name), "{name} twice");
1525	assert!(!NO_SCOPE.contains(name), "{name}");
1526	}
1527	}
1528
1529	#[test]
1530	fn scopes_are_parsed_from_oauth_text_leaving_out_unknown_ones() {
1531	assert_eq!(
1532	parse_scopes("issues:write repo:read,bogus:thing issues:write"),
1533	vec![Scope::RepoRead, Scope::IssuesWrite]
1534	);
1535	assert_eq!(scopes_text(&[Scope::RepoRead, Scope::IssuesWrite]), "repo:read issues:write");
1536	}
1537
1538	#[test]
1539	fn the_oauth_default_is_the_agent_preset_and_never_admin() {
1540	let scopes = oauth_default();
1541	assert!(scopes.contains(&Scope::IssuesWrite));
1542	assert!(scopes.contains(&Scope::PullRequestsWrite));
1543	assert!(scopes.contains(&Scope::AgentsRun));
1544	assert!(scopes.iter().all(\|scope\| !scope.dangerous()), "{scopes:?}");
1545	for read in Scope::ALL.into_iter().filter(\|scope\| scope.level() == Level::Read && scope.offered()) {
1546	// Every read offered but the machines work runs on, and chat.
1547	assert_eq!(scopes.contains(&read), read != Scope::RunnersRead && read != Scope::ChatRead, "{read:?}");
1548	}
1549	assert!(Preset::ReadOnly.scopes().unwrap().iter().all(\|scope\| scope.level() == Level::Read));
1550	assert_eq!(Preset::Full.scopes(), None);
1551	}
1552
1553	#[test]
1554	fn billing_is_read_by_presets_and_changed_by_none_but_full_access() {
1555	assert!(Preset::ReadOnly.scopes().unwrap().contains(&Scope::BillingRead));
1556	for preset in [Preset::ReadOnly, Preset::Agent, Preset::Ci] {
1557	assert!(!preset.scopes().unwrap().contains(&Scope::BillingWrite), "{}", preset.as_str());
1558	}
1559	assert_eq!(scope_for("set_budget"), Some(Scope::BillingWrite));
1560	assert_eq!(scope_for("buy_ai_credit"), Some(Scope::BillingWrite));
1561	assert_eq!(scope_for("get_usage"), Some(Scope::BillingRead));
1562	let reader = token(&[Scope::BillingRead]);
1563	assert!(decide(&reader, "list_invoices", &json!({})).allowed);
1564	assert!(decide(&reader, "set_budget", &json!({})).reason.unwrap().contains("billing:write"));
1565	}
1566
1567	#[test]
1568	fn the_ai_gateway_spends_only_with_models_write_which_no_preset_gives() {
1569	// Reading the log is a read like any other.
1570	assert_eq!(scope_for("list_gateway_requests"), Some(Scope::ModelsRead));
1571	assert!(Preset::ReadOnly.scopes().unwrap().contains(&Scope::ModelsRead));
1572	// Sending requests spends the workspace's AI credit: chosen on purpose.
1573	for preset in [Preset::ReadOnly, Preset::Agent, Preset::Ci] {
1574	assert!(!preset.scopes().unwrap().contains(&Scope::ModelsWrite), "{}", preset.as_str());
1575	}
1576	assert!(Scope::ModelsWrite.includes(Scope::ModelsRead));
1577	assert!(!Scope::ModelsWrite.dangerous());
1578	assert!(token(&[Scope::ModelsWrite]).allows(Scope::ModelsWrite));
1579	assert!(!token(&[Scope::BillingWrite]).allows(Scope::ModelsWrite));
1580	assert!(TokenAccess::full().allows(Scope::ModelsWrite));
1581	}
1582
1583	#[test]
1584	fn artifacts_are_offered_read_by_presets_and_shared_only_with_admin() {
1585	for scope in [Scope::ArtifactsRead, Scope::ArtifactsWrite, Scope::ArtifactsAdmin] {
1586	assert_eq!(scope.resource(), Resource::Artifacts);
1587	assert!(scope.offered());
1588	assert!(offered_scopes().contains(&scope));
1589	assert_eq!(parse_scopes(scope.as_str()), vec![scope]);
1590	assert!(OPERATIONS.iter().any(\|(_, needed)\| *needed == scope), "{scope:?} gates nothing");
1591	}
1592	// Reading them is a read like any other; changing them is chosen.
1593	for preset in [Preset::ReadOnly, Preset::Agent] {
1594	let scopes = preset.scopes().unwrap();
1595	assert!(scopes.contains(&Scope::ArtifactsRead), "{}", preset.as_str());
1596	assert!(!scopes.contains(&Scope::ArtifactsWrite) && !scopes.contains(&Scope::ArtifactsAdmin), "{}", preset.as_str());
1597	}
1598	assert!(!Preset::Ci.scopes().unwrap().contains(&Scope::ArtifactsRead));
1599	assert!(everything().contains(&Scope::ArtifactsAdmin));
1600	assert!(Scope::ArtifactsAdmin.includes(Scope::ArtifactsWrite));
1601	assert!(Scope::ArtifactsAdmin.dangerous());
1602	assert!(!Scope::ArtifactsWrite.dangerous());
1603	assert_eq!(Resource::Artifacts.group(), ResourceGroup::Workspace);
1604	let asked = std::collections::BTreeMap::from([("artifacts".to_owned(), "write".to_owned())]);
1605	assert_eq!(resolve_permissions(&asked, true), Ok(vec![Scope::ArtifactsWrite]));
1606	assert_eq!(offered_scopes().len(), Scope::ALL.len());
1607	// Sharing and deleting for good need admin; editing needs write.
1608	assert_eq!(scope_for("set_workspace_artifact_access"), Some(Scope::ArtifactsAdmin));
1609	assert_eq!(scope_for("purge_workspace_artifact"), Some(Scope::ArtifactsAdmin));
1610	assert_eq!(scope_for("edit_workspace_artifact"), Some(Scope::ArtifactsWrite));
1611	assert_eq!(scope_for("get_workspace_artifact_content"), Some(Scope::ArtifactsRead));
1612	let writer = token(&[Scope::ArtifactsWrite]);
1613	assert!(decide(&writer, "edit_workspace_artifact", &json!({})).allowed);
1614	assert!(decide(&writer, "list_workspace_artifacts", &json!({})).allowed, "write includes read");
1615	assert!(decide(&writer, "set_workspace_artifact_access", &json!({})).reason.unwrap().contains("artifacts:admin"));
1616	// Workflow runs' artifacts are another thing, with their own scope.
1617	let reader = token(&[Scope::ArtifactsRead]);
1618	assert!(!decide(&reader, "list_artifacts", &json!({ "repo": "acme/web" })).allowed);
1619	assert!(!decide(&token(&[Scope::WorkflowsRead]), "list_workspace_artifacts", &json!({})).allowed);
1620	}
1621
1622	#[test]
1623	fn chat_is_a_persons_own_and_given_only_when_asked_for() {
1624	for scope in [Scope::ChatRead, Scope::ChatWrite] {
1625	assert_eq!(scope.resource(), Resource::Chat);
1626	assert!(!scope.dangerous());
1627	assert_eq!(Scope::parse(scope.as_str()), Some(scope));
1628	}
1629	assert_eq!(Resource::Chat.label(), "Chat");
1630	assert_eq!(Resource::Chat.group(), ResourceGroup::Account);
1631	assert!(Scope::ChatWrite.includes(Scope::ChatRead));
1632	assert!(!Scope::ChatRead.includes(Scope::ChatWrite));
1633	// No preset, and so no OAuth default, gives it.
1634	for preset in Preset::ALL {
1635	let scopes = preset.scopes().unwrap_or_default();
1636	assert!(!scopes.iter().any(\|scope\| scope.resource() == Resource::Chat), "{}", preset.as_str());
1637	}
1638	assert!(!oauth_default().iter().any(\|scope\| scope.resource() == Resource::Chat));
1639	// An application that asks for it by name gets it; full access holds it.
1640	assert_eq!(parse_scopes("chat:read chat:write"), vec![Scope::ChatRead, Scope::ChatWrite]);
1641	assert!(offered_scopes().contains(&Scope::ChatWrite));
1642	assert!(everything().contains(&Scope::ChatWrite));
1643	assert!(TokenAccess::full().allows(Scope::ChatWrite));
1644	// Only a person's token may hold it.
1645	let asked = std::collections::BTreeMap::from([("chat".to_owned(), "write".to_owned())]);
1646	assert_eq!(resolve_permissions(&asked, true), Ok(vec![Scope::ChatWrite]));
1647	assert!(resolve_permissions(&asked, false).is_err());
1648	}
1649
1650	#[test]
1651	fn checks_are_reported_with_checks_write_which_ci_gets() {
1652	assert_eq!(scope_for("create_check_run"), Some(Scope::ChecksWrite));
1653	assert_eq!(scope_for("create_commit_status"), Some(Scope::ChecksWrite));
1654	assert_eq!(scope_for("list_check_runs_for_ref"), Some(Scope::ChecksRead));
1655	let ci = Preset::Ci.scopes().unwrap();
1656	assert!(ci.contains(&Scope::ChecksWrite));
1657	assert!(!Preset::Agent.scopes().unwrap().contains(&Scope::ChecksWrite));
1658	let reporter = token(&[Scope::ChecksWrite]);
1659	assert!(decide(&reporter, "update_check_run", &json!({ "id": "cr_1" })).allowed);
1660	assert!(decide(&reporter, "rerequest_check_run", &json!({ "id": "cr_1" })).allowed);
1661	// A g1t Actions job runs again as its workflow does.
1662	let refused = decide(&reporter, "rerequest_check_run", &json!({ "id": "job_1" }));
1663	assert!(refused.reason.unwrap().contains("workflows:write"));
1664	}
1665
1666	#[test]
1667	fn a_job_token_reaches_its_repository_only() {
1668	let job = TokenAccess {
1669	repo: Some("acme/web".into()),
1670	job: Some(JobToken { run_id: "run_1".into(), job_id: "job_1".into(), pull_requests: false }),
1671	..token(&[Scope::RepoRead, Scope::IssuesWrite, Scope::IssuesRead, Scope::PullRequestsWrite])
1672	};
1673	assert!(decide(&job, "create_issue", &json!({ "repo": "acme/web" })).allowed);
1674	assert!(decide(&job, "create_issue", &json!({ "repo": "Acme/Web" })).allowed, "names compare without case");
1675	let elsewhere = decide(&job, "create_issue", &json!({ "repo": "acme/api" }));
1676	assert!(!elsewhere.allowed);
1677	assert_eq!(elsewhere.rule, "token:repository");
1678	// Nothing beyond the one repository, a workspace's listing included.
1679	assert!(!decide(&job, "list_repos", &json!({})).allowed);
1680	assert!(decide(&job, "whoami", &json!({})).allowed);
1681	// Its scopes still hold inside it.
1682	assert!(!decide(&job, "create_pull_request", &json!({ "repo": "acme/web" })).allowed);
1683	assert!(decide_repo(&job, "acme/web").is_none());
1684	assert!(!decide_repo(&job, "acme/api").unwrap().allowed);
1685	assert!(decide_repo(&token(&[Scope::CodeRead]), "acme/api").is_none(), "other tokens reach what their owner can");
1686	// Opening and approving pull requests is off unless allowed.
1687	assert_eq!(decide(&job, "create_pull_request", &json!({ "repo": "acme/web" })).rule, "token:pull-requests");
1688	assert!(!decide(&job, "review_pull_request", &json!({ "repo": "acme/web", "verdict": "approve" })).allowed);
1689	assert!(decide(&job, "review_pull_request", &json!({ "repo": "acme/web", "verdict": "request_changes" })).allowed);
1690	let allowed = TokenAccess { job: Some(JobToken { pull_requests: true, ..job.job.clone().unwrap() }), ..job.clone() };
1691	assert!(decide(&allowed, "create_pull_request", &json!({ "repo": "acme/web" })).allowed);
1692	}
1693
1694	#[test]
1695	fn workflow_files_need_their_own_scope() {
1696	for path in [".g1t/workflows/ci.yml", ".github/workflows/deploy.yaml", "/.github/workflows/x.yml", ".GitHub/Workflows/ci.yml", ".github/workflows"] {
1697	assert!(is_workflow_file(path), "{path}");
1698	}
1699	for path in ["README.md", ".github/CODEOWNERS", ".github/workflowsx/ci.yml", "docs/.github/workflows/ci.yml", ".g1t/actions/ci.yml"] {
1700	assert!(!is_workflow_file(path), "{path}");
1701	}
1702	let code = token(&[Scope::CodeWrite]);
1703	let refused = decide_workflow_files(Some(&code), ["README.md", ".github/workflows/ci.yml"]).unwrap();
1704	assert_eq!(refused.rule, "token:workflows");
1705	assert!(refused.reason.as_deref().unwrap().contains(".github/workflows/ci.yml"));
1706	assert!(refused.reason.as_deref().unwrap().contains("workflow_files:write"));
1707	assert!(decide_workflow_files(Some(&code), ["README.md"]).is_none());
1708	assert!(decide_workflow_files(Some(&token(&[Scope::CodeWrite, Scope::WorkflowFilesWrite])), [".g1t/workflows/ci.yml"]).is_none());
1709	assert!(decide_workflow_files(Some(&TokenAccess::full()), [".g1t/workflows/ci.yml"]).is_none(), "full access");
1710	assert!(decide_workflow_files(None, [".g1t/workflows/ci.yml"]).is_none(), "a signed-in person");
1711	// A job's token never may, as GITHUB_TOKEN never may.
1712	let job = TokenAccess { job: Some(JobToken::default()), ..TokenAccess::full() };
1713	assert!(decide_workflow_files(Some(&job), [".g1t/workflows/ci.yml"]).unwrap().reason.unwrap().contains("job"));
1714	// Nothing in a preset changes workflow files but full access.
1715	for preset in [Preset::ReadOnly, Preset::Agent, Preset::Ci] {
1716	assert!(!preset.scopes().unwrap().contains(&Scope::WorkflowFilesWrite), "{}", preset.as_str());
1717	}
1718	assert!(!Scope::WorkflowFilesWrite.includes(Scope::WorkflowsWrite) && !Scope::WorkflowsWrite.includes(Scope::WorkflowFilesWrite));
1719	}
1720
1721	#[test]
1722	fn a_narrowed_token_only_reads_outside_its_workspace() {
1723	let reach = TokenReach { workspace: Some("acme".into()), repositories: RepositorySelection::All, repo_ids: Vec::new() };
1724	let fine = TokenAccess { reach: Some(reach), ..token(&[Scope::RepoRead, Scope::IssuesRead, Scope::IssuesWrite]) };
1725	assert!(decide(&fine, "create_issue", &json!({ "repo": "acme/web" })).allowed);
1726	assert!(decide(&fine, "create_issue", &json!({ "repo": "Acme/web" })).allowed);
1727	let elsewhere = decide(&fine, "create_issue", &json!({ "repo": "globex/site" }));
1728	assert_eq!(elsewhere.rule, "token:resource-owner");
1729	assert!(elsewhere.reason.unwrap().contains("acme"));
1730	assert!(decide(&fine, "get_issue", &json!({ "repo": "globex/site" })).allowed, "public repositories elsewhere read");
1731	assert!(!decide(&fine, "create_pull_request", &json!({ "repo": "acme/web" })).allowed, "its scopes still hold");
1732	let mine = TokenAccess { reach: Some(TokenReach::default()), ..token(&[Scope::IssuesWrite]) };
1733	assert!(decide(&mine, "create_issue", &json!({ "repo": "acme/web" })).reason.unwrap().contains("your account"));
1734	assert!(fine.covers_repo("rep_1", "acme") && !fine.covers_repo("rep_1", "globex"));
1735	let selected = TokenReach { workspace: Some("acme".into()), repositories: RepositorySelection::Selected, repo_ids: vec!["rep_1".into()] };
1736	assert!(selected.covers("rep_1", "ACME") && !selected.covers("rep_2", "acme"));
1737	let public = TokenReach { repositories: RepositorySelection::Public, ..selected.clone() };
1738	assert!(!public.covers("rep_1", "acme") && public.owned_by("acme"));
1739	assert!(token(&[]).covers_repo("rep_1", "anything"), "a token for every workspace reaches what its owner can");
1740	assert_eq!(RepositorySelection::parse("public_only"), Some(RepositorySelection::Public));
1741	}
1742
1743	#[test]
1744	fn permissions_are_scopes_read_per_resource() {
1745	let asked: std::collections::BTreeMap<String, String> =
1746	[("issues", "write"), ("repo", "read"), ("code", "none"), ("packages", "delete")].iter().map(\|(a, b)\| ((a).to_owned(), (b).to_owned())).collect();
1747	let scopes = resolve_permissions(&asked, true).unwrap();
1748	assert_eq!(scopes, vec![Scope::RepoRead, Scope::PackagesDelete, Scope::IssuesWrite]);
1749	let back = permissions_of(&scopes);
1750	assert_eq!(back.get("issues").map(String::as_str), Some("write"));
1751	assert_eq!(back.get("packages").map(String::as_str), Some("delete"));
1752	assert!(!back.contains_key("code"));
1753	// Lower levels held beside a higher one say nothing more.
1754	assert_eq!(top_scopes(&[Scope::RepoRead, Scope::RepoAdmin, Scope::RepoWrite]), vec![Scope::RepoAdmin]);
1755	// Every offered resource's top, and nothing a level can lose.
1756	let all = everything();
1757	assert_eq!(all.len(), Resource::ALL.into_iter().filter(\|resource\| resource.offered()).count());
1758	for scope in offered_scopes() {
1759	assert!(all.iter().any(\|held\| held.includes(scope)), "{scope:?}");
1760	}
1761	}
1762
1763	#[test]
1764	fn permissions_are_checked_by_name_level_and_owner() {
1765	let one = \|name: &str, level: &str\| -> std::collections::BTreeMap<String, String> { [(name.to_owned(), level.to_owned())].into() };
1766	assert!(resolve_permissions(&one("wiki", "read"), true).unwrap_err().contains("wiki"));
1767	assert!(resolve_permissions(&one("issues", "admin"), true).unwrap_err().contains("read, write"));
1768	assert!(resolve_permissions(&one("workflow_files", "read"), true).is_err(), "workflow files are written only");
1769	assert!(resolve_permissions(&one("notifications", "read"), false).unwrap_err().contains("account"));
1770	assert_eq!(resolve_permissions(&one("notifications", "read"), true).unwrap(), vec![Scope::NotificationsRead]);
1771	assert_eq!(resolve_permissions(&one("agents", "run"), false).unwrap(), vec![Scope::AgentsRun]);
1772	for resource in Resource::ALL {
1773	assert_eq!(Resource::parse(resource.as_str()), Some(resource));
1774	assert!(!resource.scopes().is_empty());
1775	}
1776	}
1777
1778	#[test]
1779	fn a_legacy_token_can_do_everything() {
1780	let legacy = TokenAccess { legacy: true, ..TokenAccess::full() };
1781	for (operation, _) in OPERATIONS {
1782	assert!(decide(&legacy, operation, &json!({})).allowed, "{operation}");
1783	}
1784	assert_eq!(decide(&legacy, "delete_repo", &json!({})).rule, "token:legacy");
1785	}
1786
1787	#[test]
1788	fn a_missing_scope_is_named() {
1789	let read = token(&[Scope::IssuesRead]);
1790	assert!(decide(&read, "get_issue", &json!({})).allowed);
1791	assert!(decide(&read, "whoami", &json!({})).allowed);
1792	let refused = decide(&read, "create_issue", &json!({}));
1793	assert!(!refused.allowed);
1794	assert_eq!(refused.reason.as_deref(), Some("This access token needs the issues:write scope to use create_issue."));
1795	// An operation the table does not know needs full access.
1796	assert!(!decide(&read, "something_new", &json!({})).allowed);
1797	}
1798
1799	#[test]
1800	fn starting_agents_from_another_operation_needs_agents_run() {
1801	let writer = token(&[Scope::IssuesWrite]);
1802	assert!(decide(&writer, "apply_plan", &json!({})).allowed);
1803	let refused = decide(&writer, "apply_plan", &json!({ "assign": true }));
1804	assert!(refused.reason.unwrap().contains("agents:run"));
1805	let maintainer = token(&[Scope::RepoWrite]);
1806	assert!(decide(&maintainer, "update_repo", &json!({ "description": "x" })).allowed);
1807	assert!(!decide(&maintainer, "update_repo", &json!({ "private": true })).allowed);
1808	}
1809
1810	#[test]
1811	fn a_workspaces_base_permission_needs_access_admin_too() {
1812	let admin = token(&[Scope::WorkspaceAdmin]);
1813	assert!(decide(&admin, "update_workspace", &json!({ "name": "Acme" })).allowed);
1814	let refused = decide(&admin, "update_workspace", &json!({ "name": "Acme", "base_permission": "read" }));
1815	assert!(refused.reason.unwrap().contains("access:admin"));
1816	let both = token(&[Scope::WorkspaceAdmin, Scope::AccessAdmin]);
1817	assert!(decide(&both, "update_workspace", &json!({ "base_permission": "read" })).allowed);
1818	assert!(!decide(&token(&[Scope::WorkspaceRead]), "update_workspace", &json!({ "name": "Acme" })).allowed);
1819	}
1820
1821	#[test]
1822	fn delegating_needs_both_agents_and_issues() {
1823	let agents = token(&[Scope::AgentsRun]);
1824	assert!(decide(&agents, "delegate", &json!({})).reason.unwrap().contains("issues:write"));
1825	let both = token(&[Scope::AgentsRun, Scope::IssuesWrite]);
1826	assert!(decide(&both, "delegate", &json!({})).allowed);
1827	}
1828
1829	#[test]
1830	fn git_push_needs_code_write_and_private_reads_need_code_read() {
1831	let reader = token(&[Scope::CodeRead]);
1832	assert!(decide_git(&reader, false, false).allowed);
1833	let refused = decide_git(&reader, true, false);
1834	assert!(!refused.allowed);
1835	assert!(refused.reason.unwrap().contains("code:write"));
1836	let issues = token(&[Scope::IssuesWrite]);
1837	assert!(!decide_git(&issues, false, false).allowed);
1838	assert!(decide_git(&issues, false, true).allowed, "public code needs no scope");
1839	assert!(!decide_git(&issues, true, true).allowed, "pushing to public code still needs code:write");
1840	let writer = token(&[Scope::CodeWrite]);
1841	assert!(decide_git(&writer, true, false).allowed);
1842	assert!(decide_git(&writer, false, false).allowed, "code:write includes code:read");
1843	assert!(decide_git(&TokenAccess::full(), true, false).allowed);
1844	}
1845
1846	#[test]
1847	fn packages_need_their_own_scopes_and_public_pulls_none() {
1848	let reader = token(&[Scope::PackagesRead]);
1849	assert!(decide_packages(&reader, Level::Read, false).allowed);
1850	assert!(!decide_packages(&reader, Level::Write, false).allowed);
1851	let code = token(&[Scope::CodeWrite]);
1852	assert!(!decide_packages(&code, Level::Read, false).allowed, "code scopes are not package scopes");
1853	assert!(decide_packages(&code, Level::Read, true).allowed, "public packages pull with any token");
1854	let writer = token(&[Scope::PackagesWrite]);
1855	assert!(decide_packages(&writer, Level::Write, false).allowed);
1856	assert!(decide_packages(&writer, Level::Read, false).allowed, "packages:write includes packages:read");
1857	let refused = decide_packages(&writer, Level::Delete, false);
1858	assert!(refused.reason.unwrap().contains("packages:delete"));
1859	assert!(decide_packages(&token(&[Scope::PackagesDelete]), Level::Write, false).allowed);
1860	assert!(Scope::PackagesDelete.dangerous());
1861	// Tokens made before these scopes, and full-access ones, keep working.
1862	let legacy = TokenAccess { legacy: true, ..TokenAccess::full() };
1863	assert!(decide_packages(&legacy, Level::Delete, false).allowed);
1864	assert!(decide_packages(&TokenAccess::full(), Level::Write, false).allowed);
1865	}
1866
1867	#[test]
1868	fn token_access_travels_as_json() {
1869	let access = token(&[Scope::IssuesRead]);
1870	let wire = serde_json::to_value(&access).unwrap();
1871	assert_eq!(wire["scopes"], json!(["issues:read"]));
1872	assert!(wire.get("resources").is_none());
1873	let back: TokenAccess = serde_json::from_value(wire).unwrap();
1874	assert_eq!(back, access);
1875	let full: TokenAccess = serde_json::from_value(json!({})).unwrap();
1876	assert!(full.is_full());
1877	// A reach written by an older version is ignored: a token reaches
1878	// whatever its owner can.
1879	let older: TokenAccess = serde_json::from_value(json!({
1880	"token_id": "tok_1",
1881	"scopes": ["issues:read"],
1882	"resources": { "kind": "repositories", "repositories": ["acme/rocket"] },
1883	}))
1884	.unwrap();
1885	assert_eq!(older, access);
1886	// Using the website is off unless set, and said only when on.
1887	assert!(!access.website);
1888	assert!(wire_of(&access).get("website").is_none());
1889	let website = TokenAccess { website: true, ..access };
1890	assert_eq!(wire_of(&website)["website"], json!(true));
1891	// Never part of full access.
1892	assert!(!TokenAccess::full().website);
1893	}
1894
1895	fn wire_of(access: &TokenAccess) -> serde_json::Value {
1896	serde_json::to_value(access).unwrap()
1897	}
1898
1899	/// The site's copy of the table, `packages/contracts/src/scopes.ts`,
1900	/// lists the same scopes in the same order, the same operations with
1901	/// the same scopes, and the same presets.
1902	#[test]
1903	fn the_typescript_mirror_has_the_same_table() {
1904	let ts = include_str!("../../../packages/contracts/src/scopes.ts");
1905	let section = \|start: &str\| {
1906	ts.split_once(start)
1907	.and_then(\|(_, rest)\| rest.split_once("] as const"))
1908	.map(\|(table, _)\| table)
1909	.unwrap_or_else(\|\| panic!("{start} in scopes.ts"))
1910	};
1911	let names = \|table: &str\| -> Vec<String> {
1912	section(table)
1913	.lines()
1914	.filter_map(\|line\| line.split_once("scope: \"").and_then(\|(_, rest)\| rest.split_once('"')).map(\|(scope, _)\| scope.to_owned()))
1915	.collect()
1916	};
1917	// Offered scopes in `SCOPES`, the rest in `UPCOMING_SCOPES`.
1918	let offered: Vec<String> = Scope::ALL.iter().filter(\|scope\| scope.offered()).map(\|scope\| scope.as_str().to_owned()).collect();
1919	let upcoming: Vec<String> = Scope::ALL.iter().filter(\|scope\| !scope.offered()).map(\|scope\| scope.as_str().to_owned()).collect();
1920	assert_eq!(names("export const SCOPES = ["), offered);
1921	assert_eq!(names("export const UPCOMING_SCOPES"), upcoming);
1922	let operations: Vec<(String, String)> = section("export const OPERATION_SCOPES = [")
1923	.lines()
1924	.filter_map(\|line\| {
1925	let mut quoted = line.split('"').skip(1).step_by(2);
1926	Some((quoted.next()?.to_owned(), quoted.next()?.to_owned()))
1927	})
1928	.collect();
1929	let expected: Vec<(String, String)> = OPERATIONS
1930	.iter()
1931	.map(\|(name, scope)\| ((*name).to_owned(), scope.as_str().to_owned()))
1932	.collect();
1933	assert_eq!(operations, expected);
1934	for preset in Preset::ALL {
1935	let list = section(&format!("{}: [", preset.as_str()));
1936	let mirrored: Vec<&str> = list
1937	.split(',')
1938	.map(\|item\| item.trim().trim_matches('"'))
1939	.filter(\|item\| !item.is_empty())
1940	.collect();
1941	let expected: Vec<&str> = preset
1942	.scopes()
1943	.map(\|scopes\| scopes.iter().map(\|scope\| scope.as_str()).collect())
1944	.unwrap_or_else(\|\| vec!["*"]);
1945	assert_eq!(mirrored, expected, "{}", preset.as_str());
1946	}
1947	// Each resource with its group, in the same order: offered ones in
1948	// `SCOPE_RESOURCES`, the rest in `UPCOMING_RESOURCES`.
1949	for (table, offered) in [("export const SCOPE_RESOURCES", true), ("export const UPCOMING_RESOURCES", false)] {
1950	let resources = ts
1951	.split_once(table)
1952	.and_then(\|(_, rest)\| rest.split_once("
1953	];"))
1954	.map(\|(table, _)\| table)
1955	.unwrap_or_else(\|\| panic!("{table} in scopes.ts"));
1956	let rows: Vec<&str> = resources.lines().filter(\|line\| line.trim_start().starts_with("{ resource:")).collect();
1957	let expected: Vec<Resource> = Resource::ALL.into_iter().filter(\|resource\| resource.offered() == offered).collect();
1958	assert_eq!(rows.len(), expected.len(), "{table}");
1959	for (row, resource) in rows.iter().zip(expected) {
1960	assert!(row.contains(&format!("resource: \"{}\"", resource.as_str())), "{row}");
1961	assert!(row.contains(&format!("group: \"{}\"", resource.group().as_str())), "{row}");
1962	}
1963	}
1964	}
1965	}