syntaqxA workspace token for all of its workspace's repositories is held to that workspace. Identity resolved such a token with no reach (only a token for chosen repositories had one), so the API's resource-owner check never applied to it: with issues or pull-requests write it could open issues, comment or open pull requests on any other workspace's public repository as the workspace, which the docs said it could not. apply_reach now gives every workspace token a reach of its own workspace, all of its repositories or the ones chosen (workspace_token_reach), the shape a person's token made for one workspace already has; outside it, it reads public repositories as anyone may and changes nothing (token:resource-owner). Inside its workspace nothing changes. Checked: cargo test -p g1t-identity --lib (177, new: a workspace token never writes outside its workspace, for all or chosen repositories; one for all covers its own repositories only) and its wasm32 check.b235b5eHistory
- ..
- folios
- kinds
- access.test.ts
- access.ts
- blocks.ts
- chunks.test.ts
- chunks.ts
- citations.test.ts
- citations.ts
- diff.test.ts
- diff.ts
- edits.test.ts
- edits.ts
- embed-billing.test.ts
- embed-billing.ts
- erasure.ts
- events.ts
- files.test.ts
- files.ts
- folio-access.test.ts
- index.ts
- indexer.test.ts
- indexer.ts
- markdown.test.ts
- markdown.ts
- persist.ts
- quota.test.ts
- quota.ts
- recall.test.ts
- recall.ts
- repo-docs.test.ts
- repo-docs.ts
- repo-spaces.ts
- room.ts
- search.test.ts
- search.ts
- sigv4.test.ts
- sigv4.ts
- slugs.test.ts
- slugs.ts
- staleness.ts
- templates.ts
- threads.test.ts
- threads.ts
- tree.test.ts
- tree.ts
- vectors.ts
- who.ts