feat(outline): let the legacy gate answer for the wiki #715

Merged

binjovi-bot merged 1 commit from feat/outline-legacy-access into trunk

2026-09-13 16:56:57 +00:00

sean commented

2026-09-13 16:55:35 +00:00

Owner

Every service operation on sean/outline failed denied at attempt 2 — both
collaborators, both webhooks, both branch protections. None of them reached
Forgejo.

The gate

This Role exists so the worker can tell an absent legacy rule from a
denied read, and it scopes that read by resourceNames. The file says it
plainly:

a name IN this list that has no CR returns 404 → absent, and a name NOT in the
list returns 403 → denied

outline was in no list. Measured from inside the control-plane pod with its own
projected token:

forgejocollaborators/outline-binjovi-bot     -> 403
forgejowebhooks/binjovi-ingest-outline       -> 403
forgejobranchprotections/outline-main        -> 403

Only the kinds that actually look up a name

ForgejoRepositoryBindings.legacy_names and ForgejoPushMirrorBindings.legacy_names
both return [] for a repository outside the static catalog, so
ServiceLegacyClient short-circuits to "absent" with no API call. That is
why the repository create reached verified while everything else was refused —
and why neither forgejorepositories nor forgejopushmirrors needs an entry.

A first draft added both. tests/binjovi-repository-bootstrap.sh refused it,
because that list is tied to the 39 bootstrap records. The guard was right.

So five names, across the three kinds that do perform a lookup:

list	names
`forgejobranchprotections`	`outline-main`, `outline-trunk`
`forgejowebhooks`	`binjovi-ingest-outline`, `outline-argocd-sync`
`forgejocollaborators`	`outline-binjovi-bot`, `outline-binjovi-operator-bot`

Counts move with the lists: 66 → 68, 79 → 81, 39 → 41.

Not the push mirror

Its create is refused by codeberg, not by this gate: the mirror credential
authenticates as seanfarm, and the destination owner someara is a USER, not an
org — so POST /user/repos cannot produce someara/outline. Separate problem,
untouched here.

tests/check.sh green: 108 guards.

https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

Every service operation on `sean/outline` failed `denied` at attempt 2 — both collaborators, both webhooks, both branch protections. None of them reached Forgejo. ## The gate This Role exists so the worker can tell an **absent** legacy rule from a **denied** read, and it scopes that read by `resourceNames`. The file says it plainly: > a name IN this list that has no CR returns 404 → absent, and a name NOT in the > list returns 403 → denied `outline` was in no list. Measured from inside the control-plane pod with its own projected token: ``` forgejocollaborators/outline-binjovi-bot -> 403 forgejowebhooks/binjovi-ingest-outline -> 403 forgejobranchprotections/outline-main -> 403 ``` ## Only the kinds that actually look up a name `ForgejoRepositoryBindings.legacy_names` and `ForgejoPushMirrorBindings.legacy_names` both return `[]` for a repository outside the static catalog, so `ServiceLegacyClient` short-circuits to `"absent"` **with no API call**. That is why the repository create reached `verified` while everything else was refused — and why neither `forgejorepositories` nor `forgejopushmirrors` needs an entry. A first draft added both. `tests/binjovi-repository-bootstrap.sh` refused it, because that list is tied to the 39 bootstrap records. The guard was right. So five names, across the three kinds that do perform a lookup: | list | names | |---|---| | `forgejobranchprotections` | `outline-main`, `outline-trunk` | | `forgejowebhooks` | `binjovi-ingest-outline`, `outline-argocd-sync` | | `forgejocollaborators` | `outline-binjovi-bot`, `outline-binjovi-operator-bot` | Counts move with the lists: 66 → 68, 79 → 81, 39 → 41. ## Not the push mirror Its create is refused by **codeberg**, not by this gate: the mirror credential authenticates as `seanfarm`, and the destination owner `someara` is a USER, not an org — so `POST /user/repos` cannot produce `someara/outline`. Separate problem, untouched here. `tests/check.sh` green: 108 guards. https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

sean added 1 commit

2026-09-13 16:55:35 +00:00

feat(outline): let the legacy gate answer for the wiki

binjovi/ci Binjovi failed the frozen plan

Details

d9c882df1d

Every service operation on sean/outline failed `denied` at attempt 2 --
both collaborators, both webhooks and both branch protections. None of
them reached Forgejo.

The gate reads the legacy CR by name to tell an ABSENT rule from a
DENIED one, and this Role scopes that read by resourceNames. A name in
the list with no CR returns 404 and reads as absent; a name NOT in the
list returns 403 and reads as denied. outline was in no list. Measured
from inside the control-plane pod: all three paths answered 403.

ONLY THE THREE KINDS THAT ACTUALLY LOOK UP A NAME ARE GRANTED.
ForgejoRepositoryBindings.legacy_names and
ForgejoPushMirrorBindings.legacy_names both return [] for a repository
outside the static catalog, so ServiceLegacyClient short-circuits to
"absent" with no API call at all. That is why the repository create
reached `verified` while everything else was refused, and it is why
neither forgejorepositories nor forgejopushmirrors needs an entry here.
A first draft added both; tests/binjovi-repository-bootstrap.sh refused
it, because that list is tied to the 39 bootstrap records.

The push mirror is a separate failure and this does not touch it: its
create is refused by codeberg, where the mirror credential authenticates
as `seanfarm` and the destination owner `someara` is a USER, not an org.

Counts move with the lists: 66 -> 68 branch protections, 79 -> 81
collaborators, 39 -> 41 webhooks.

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

sean force-pushed feat/outline-legacy-access from d9c882df1d

binjovi/ci Binjovi failed the frozen plan

Details

to 55a70d8df2

binjovi/ci Binjovi completed the frozen plan

Details

2026-09-13 16:56:10 +00:00

Compare