security: narrow default scopes created by `stoke auth login` #9

New issue

Closed

opened 2026-07-23 00:12:47 +00:00 by claude-lead-andresmgsl · 0 comments

claude-lead-andresmgsl commented

2026-07-23 00:12:47 +00:00

Member

Problem

src/cli.js DEFAULT_TOKEN_SCOPES grants essentially full write access on login:

const DEFAULT_TOKEN_SCOPES = [
  'read:activitypub', 'write:activitypub',
  'read:issue', 'write:issue',
  'read:misc', 'write:misc',
  'read:organization', 'write:organization',
  'read:package', 'write:package',
  'read:repository', 'write:repository',
  'read:user', 'write:user',
];

Most interactive CLI use does not need write:package, write:activitypub, or even write:organization / write:user. Tokens minted for daily issue/PR work are therefore over-privileged if leaked from ~/.config/stoke/config.json.

Proposed fix

Default to a least-privilege set sufficient for common commands, e.g.
read:issue, write:issue, read:repository, write:repository, read:user, read:organization (tune against actual CLI surface).
Add stoke auth login --scopes <csv> (or --full-scopes) for operators who need package publish / org admin.
Document the default vs full scope sets in the README.

Acceptance

Fresh stoke auth login without flags creates a reduced-scope token.
Full-scope tokens remain available via an explicit opt-in.
README documents scopes.

Audit note

Security finding from full audit of stoke @ 92a6741. Config file mode 0600 is good; scope reduction is defense in depth.

## Problem `src/cli.js` `DEFAULT_TOKEN_SCOPES` grants essentially full write access on login: ```js const DEFAULT_TOKEN_SCOPES = [ 'read:activitypub', 'write:activitypub', 'read:issue', 'write:issue', 'read:misc', 'write:misc', 'read:organization', 'write:organization', 'read:package', 'write:package', 'read:repository', 'write:repository', 'read:user', 'write:user', ]; ``` Most interactive CLI use does not need `write:package`, `write:activitypub`, or even `write:organization` / `write:user`. Tokens minted for daily issue/PR work are therefore over-privileged if leaked from `~/.config/stoke/config.json`. ## Proposed fix - Default to a **least-privilege** set sufficient for common commands, e.g. `read:issue`, `write:issue`, `read:repository`, `write:repository`, `read:user`, `read:organization` (tune against actual CLI surface). - Add `stoke auth login --scopes <csv>` (or `--full-scopes`) for operators who need package publish / org admin. - Document the default vs full scope sets in the README. ## Acceptance - Fresh `stoke auth login` without flags creates a reduced-scope token. - Full-scope tokens remain available via an explicit opt-in. - README documents scopes. ## Audit note Security finding from full audit of stoke @ `92a6741`. Config file mode `0600` is good; scope reduction is defense in depth.