caleb-brown/temper
1
0
Fork 0
Code Issues 36 Pull requests Projects Releases Packages Wiki Activity Actions

Connect and verify a Forgejo service identity #11

New issue
Open
opened 2026-07-14 22:32:17 -04:00 by caleb-brown · 0 comments
caleb-brown commented 2026-07-14 22:32:17 -04:00
Owner
Copy link

What to build

A Temper Operator can connect a Forgejo host using a dedicated service account and repository-scoped personal access token, then verify the host, token, and accessible repository boundary.

Acceptance criteria

  • An Operator can configure a Forgejo host and repository-scoped PAT without an OAuth flow.
  • The PAT is encrypted, never redisplayed, omitted from logs, and never forwarded across an origin-changing redirect.
  • Connection testing identifies the Forgejo version and verifies the API capabilities and permissions required for repository discovery and review publication.
  • Accessible repositories can be listed without implying permission to repositories outside the PAT's scope.
  • Unsupported Forgejo versions and under-scoped or revoked PATs produce explicit remediation guidance.
  • The prototype OAuth ADR is superseded and the domain glossary reflects the PAT-backed Forgejo connection model.
  • Forgejo adapter contract tests cover authentication, version detection, pagination, permission failure, and token revocation.

Blocked by

  • #9 — Boot a secure Temper Deployment
## What to build A Temper Operator can connect a Forgejo host using a dedicated service account and repository-scoped personal access token, then verify the host, token, and accessible repository boundary. ## Acceptance criteria - [ ] An Operator can configure a Forgejo host and repository-scoped PAT without an OAuth flow. - [ ] The PAT is encrypted, never redisplayed, omitted from logs, and never forwarded across an origin-changing redirect. - [ ] Connection testing identifies the Forgejo version and verifies the API capabilities and permissions required for repository discovery and review publication. - [ ] Accessible repositories can be listed without implying permission to repositories outside the PAT's scope. - [ ] Unsupported Forgejo versions and under-scoped or revoked PATs produce explicit remediation guidance. - [ ] The prototype OAuth ADR is superseded and the domain glossary reflects the PAT-backed Forgejo connection model. - [ ] Forgejo adapter contract tests cover authentication, version detection, pagination, permission failure, and token revocation. ## Blocked by - [#9](https://git.caleb-brown.dev/caleb-brown/temper/issues/9) — Boot a secure Temper Deployment
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
dev
t3code/hygiene-review
t3code/configurable-llm-timeout
fix/openai-non-streaming-completions
t3code/test-incorrect-changes
No results found.
Labels
Clear labels   
ready-for-agent
Fully specified and ready for an implementation agent

  
wayfinder:grilling
Human-in-the-loop product or domain decision

  
wayfinder:map
Canonical Wayfinder map

  
wayfinder:prototype
Human-in-the-loop concrete prototype

  
wayfinder:research
Agent-driven primary-source research

  
wayfinder:task
Task that unblocks a Wayfinder decision

No labels
ready-for-agent
wayfinder:grilling
wayfinder:map
wayfinder:prototype
wayfinder:research
wayfinder:task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#12 Install a repository and prove webhook delivery
caleb-brown/temper
#15 Produce a bounded review result
caleb-brown/temper
#23 Rotate service credentials and encryption keys
caleb-brown/temper
Depends on
#9 Boot a secure Temper Deployment
caleb-brown/temper
Reference
caleb-brown/temper#11
No description provided.