syntaqxA workspace token for all of its workspace's repositories is held to that workspace. Identity resolved such a token with no reach (only a token for chosen repositories had one), so the API's resource-owner check never applied to it: with issues or pull-requests write it could open issues, comment or open pull requests on any other workspace's public repository as the workspace, which the docs said it could not. apply_reach now gives every workspace token a reach of its own workspace, all of its repositories or the ones chosen (workspace_token_reach), the shape a person's token made for one workspace already has; outside it, it reads public repositories as anyone may and changes nothing (token:resource-owner). Inside its workspace nothing changes. Checked: cargo test -p g1t-identity --lib (177, new: a workspace token never writes outside its workspace, for all or chosen repositories; one for all covers its own repositories only) and its wasm32 check.b235b5eHistory
- ..
- about.rs
- activity.rs
- addresses.rs
- alerts.rs
- archives.rs
- audit.rs
- billing.rs
- blobs.rs
- broker.rs
- caches.rs
- checks.rs
- commits.rs
- contents.rs
- coordination.rs
- deploy_keys.rs
- deployments.rs
- folios.rs
- follow.rs
- lib.rs
- limits.rs
- logs.rs
- mcp.rs
- notifications.rs
- oauth.rs
- oidc.rs
- openapi.rs
- operations.rs
- packages.rs
- people.rs
- pins.rs
- projects.rs
- protection.rs
- reference.json
- renamed.rs
- responses.rs
- rest.rs
- rules.rs
- run_artifacts.rs
- runners.rs
- security.rs
- telemetry.rs
- token_policy.rs
- toolkit.rs
- tools.rs
- why.rs