Repository navigation
Document the roster rule as the token rule it is - #20
Merged
Merged
Conversation
GET /orgs/{org}/members asks what the presented token covers, like
every other read, so a member whose token does not name the
organisation is answered 403. The docs said membership was enough in
four places -- the module table, the handler comment, the OpenAPI
description and the README's endpoint table -- which makes the 403 an
admin meets right after creating an organisation look like a bug
rather than the rule. They now say the presented token must name the
organisation, and the module doc separates the roster rule from the
POST /tokens rule above it.
The description is part of the contract, so the server snapshot and
the generated client move with it, one line each.
docs/hosting.md gains a section on making an organisation: it is done
in the UI, in two steps (create it, then issue a token that names it),
and says why the second step is needed.
Signed-off-by: Yutaka Nishimura <ytk.nishimura@gmail.com>
ynishi
force-pushed
the
chore/org-script
branch
from
September 23, 2026 13:56
7245344 to
5bc5633
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #18.
The roster rule, documented
GET /orgs/{org}/membersasks what the presented token covers, like every other read: a member whose token does not name the organisation is answered403. So the token that creates an organisation cannot read its members until a second token names it.Four places said membership was enough — the module doc's endpoint table, the handler's comment,
/openapi.jsonand the README's endpoint table. All four were true about the role and silent about the token, which is the half that answers403. They now say that the presented token must name the organisation, and the module doc gains the paragraph that separates the roster rule from thePOST /tokensrule above it.That is a comment-only change with one visible edge: the operation's description in the contract.
crates/evalhub-server/tests/snapshots/boot__openapi.snapandweb/src/lib/api/schema.d.tsare regenerated here, one line each.docs/hosting.md
A new section, An organisation: made in the UI, in two steps — Settings creates it, then Settings issues a token that names it — with why the second step is needed and what
writeandadminbuy.An earlier revision of this branch added
deploy/fly/org.shfor the same two steps. It was dropped: it calls only the public API, nothing Fly-specific, so it does not belong besideup.sh/down.sh/user.sh, and it duplicates what the UI does. The UI's dead end after creating an organisation is #19.Verification
cargo fmt --check,cargo clippy -p evalhub-server --all-targets -- -D warnings,cargo test -p evalhub-server --test boot(the snapshot test). The rest ofcargo test -p evalhub-serverwas not run here.web/changes only the generatedschema.d.tscomment.