Help us shape the future of Go! Take the 2026 Go Developer Survey

scopes

package
v3.0.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 22, 2026 License: Apache-2.0 Imports: 3 Imported by: 0

Documentation

Overview

Package scopes is the one source of truth for the OAuth scopes this server requests in each mode, the scope each kind of tool needs, and the text people paste when they register their OAuth application.

GitLab offers nothing between read_api and api for the REST surface (§2.6): read_api is enforced by HTTP method and covers every GET, and api covers everything else, merging and deleting included. So the scope follows read-only mode alone. The Ship and Destructive flags change what is registered, not what is requested, which is why registration is the control (§4.3, §9.4).

docs/setup.md's application block is generated from SetupBlock and compared exactly by the staleness gate.

Index

Constants

View Source 
const (
	// API is read and write access to the whole REST API.
	API = "api"
	// ReadAPI is GET and HEAD on the REST API.
	ReadAPI = "read_api"
)

GitLab scopes.

View Source 
const RedirectURI = "http://127.0.0.1/callback"

RedirectURI is the redirect URI people register with their OAuth application, and the one login sends. GitLab ignores the port of a loopback IP literal when it compares redirect URIs (§18 row 1), so the registered URI carries none and login listens on 127.0.0.1:0. `localhost` would need an exact port (§18 row 2).

Variables

This section is empty.

Functions

func ForMode 

func ForMode(m Mode) []string

ForMode is the set login requests in a mode.

func Missing 

func Missing(granted, needed []string) []string

Missing returns the scopes of needed that granted does not cover, in needed's order.

func Parse 

func Parse(s string) []string

Parse splits the scope string of a token response. OAuth separates scopes with spaces (RFC 6749 §3.3); extra whitespace is ignored.

func Required 

func Required(k Kind) string

Required is the narrowest scope that lets a tool of kind k work. Read needs read_api, which api also covers; everything else needs api. An unknown kind needs api, the answer that never registers a write under a read-only token.

func Satisfied 

func Satisfied(granted []string, needed string) bool

Satisfied reports whether granted covers needed, directly or through a wider scope.

func SetupBlock 

func SetupBlock(m Mode) string

SetupBlock is the exact text people follow when they register the OAuth application for mode m: GitLab's form fields and the value each takes. docs/setup.md carries one block per mode, generated from this.

Types

type Kind 

type Kind string

Kind is what a tool does, as far as scopes are concerned. It mirrors the kinds of §4.3; the tool registry maps its own kind onto this one. 

const (
	KindRead        Kind = "read"
	KindWrite       Kind = "write"
	KindShip        Kind = "ship"
	KindDestructive Kind = "destructive"
)

Kinds.

func Kinds 

func Kinds() []Kind

Kinds is every kind, in the order §4.3 tabulates them.

type Mode 

type Mode string

Mode is a configuration with a distinct meaning for scopes. 

const (
	ModeReadOnly Mode = "read-only"
	ModeDefault  Mode = "default"
)

Modes.

func ModeFor 

func ModeFor(readOnly bool) Mode

ModeFor is the mode a configuration is in.

type ModeRow 

type ModeRow struct {
	Mode   Mode
	Flags  []string
	Scopes []string
}

ModeRow is one row of the scope table: a mode, the settings that select it, and what login requests in it.

func Modes 

func Modes() []ModeRow

Modes is every mode with the settings that select it, in the order the documentation tabulates them. Built from ForMode, so the table cannot say one thing while login does another.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.