It might make sense to support "token scoping" such that API tokens are model - only capable of individual actions like push, yank, etc. This makes sense when you want to hand out a lower degree of access.
Can be deferred though, not an immediate concern.
Add scope fields to CargoToken:
distributions — M2M to RustDistribution (empty = all the user has access to)actions — JSON list of allowed actions (["publish", "yank"], empty = all)
This mirrors crates.io's RFC 2947 token scoping.
It might make sense to support "token scoping" such that API tokens are model - only capable of individual actions like push, yank, etc. This makes sense when you want to hand out a lower degree of access.
Can be deferred though, not an immediate concern.
Add scope fields to
CargoToken:distributions— M2M toRustDistribution(empty = all the user has access to)actions— JSON list of allowed actions (["publish", "yank"], empty = all)This mirrors crates.io's RFC 2947 token scoping.