Anvil
fangorn/anvil-cli public
ref:4678688003d89edc038f52b3975d4520a0b14baa

fix: include repo:admin in auth login default scopes (#25)

`anvil auth login`'s device flow omitted repo:admin from DEFAULT_SCOPES, so login-flow tokens 403 on `ci set-secret`/`delete-secret`/list-secrets — the server gates those on repo:admin, matched exactly with no hierarchy. The comment had conflated the ORG-level admin:* scopes (correctly excluded) with the REPO-level repo:admin. Add repo:admin so the shipped `anvil ci ...secret...` commands work from a normal login. Closes #25 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
SHA: 4678688003d89edc038f52b3975d4520a0b14baa
Author: CI <ci@anvil.test>
Date: 2026-07-12 23:25
Parents: 914e7cf
1 files changed +5 -2
Type
src/commands/auth.rs +5 −2 
@@ -7,11 +7,14 @@
const CLIENT_ID: &str = "anvil-cli";
/// Scopes the CLI requests when starting a device-flow login. Mirrors
/// the breadth of the CLI's command surface. Includes the repo-level
/// `repo:admin` (needed by `ci set-secret` and friends); only the
/// ORG-level `admin:*` scopes are excluded — anything that needs those
/// should provision a PAT explicitly.
/// the breadth of the CLI's command surface (no `admin:*` — anything
/// that needs admin should provision a PAT explicitly).
const DEFAULT_SCOPES: &[&str] = &[
    "repo:read",
    "repo:write",
    "repo:admin",
    "issues:read",
    "issues:write",
    "ci:read",