refactor: moved scope names and the capability budget into 'pkg/tokens' #5

Merged

jak merged 2 commits from review/tokens-budget-scopes into groups-capabilities

2026-10-20 16:03:30 -04:00

jak commented

2026-10-20 14:24:11 -04:00

Owner

Moves the shared scope vocabulary and the capability budget builder into pkg/tokens.

New public API: tokens.ScopeIdentity, tokens.ScopeProfile, tokens.ScopeGroups, tokens.ScopeNames() (sorted, fresh slice), and tokens.NewCapabilityBudget(issuer, audience, capabilities), which fills Scopes with every scope.
Removed service.ScopeIdentity/ScopeProfile/ScopeGroups, service.ScopeNames, and service.BuildIntegrationCapabilityBudget. internal/service keeps labels and descriptions keyed by the tokens constants.
pkg/client/manifest.go no longer imports internal/service. pkg/client still depends on it through internal/api, which is out of scope here.
Updated package docs, README, and the production integration skill. Added tests for the scope list, the constructor, and service definitions that cover every token scope.

make test passes.

🤖 Generated with Claude Code

Moves the shared scope vocabulary and the capability budget builder into `pkg/tokens`. - New public API: `tokens.ScopeIdentity`, `tokens.ScopeProfile`, `tokens.ScopeGroups`, `tokens.ScopeNames()` (sorted, fresh slice), and `tokens.NewCapabilityBudget(issuer, audience, capabilities)`, which fills Scopes with every scope. - Removed `service.ScopeIdentity`/`ScopeProfile`/`ScopeGroups`, `service.ScopeNames`, and `service.BuildIntegrationCapabilityBudget`. `internal/service` keeps labels and descriptions keyed by the tokens constants. - `pkg/client/manifest.go` no longer imports `internal/service`. pkg/client still depends on it through `internal/api`, which is out of scope here. - Updated package docs, README, and the production integration skill. Added tests for the scope list, the constructor, and service definitions that cover every token scope. `make test` passes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jak added 1 commit

2026-10-20 14:24:12 -04:00

refactor: moved scope names and the capability budget into 'pkg/tokens' 19a4ec99d9

Scope names are shared between Consent and the apps that integrate with it,
but only 'internal/service' defined them. 'client.CheckCapabilityBudget'
imported the service package to build its budget.

'pkg/tokens' now exports 'ScopeIdentity', 'ScopeProfile', 'ScopeGroups', and
'ScopeNames'. 'NewCapabilityBudget' builds a budget that holds every scope.
The service keeps only the scope labels and descriptions, keyed by these
constants. We removed 'service.ScopeNames' and
'service.BuildIntegrationCapabilityBudget'.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

jak added 1 commit

2026-10-20 15:53:23 -04:00

refactor: made 'pkg/tokens' the only list of scopes d0d0b459da

After the previous commit, scopes were listed twice: in 'tokens.ScopeNames'
and as the keys of the service's scope registry. The registry decided which
scopes a request could include, while 'ScopeNames' fed the capability budget.
A scope added only to the registry would have been grantable but missing from
the budget, so the budget could undercount the largest token.

'pkg/tokens' now holds the one table of scopes and their dependencies.
'ScopeNames' reads from it, and the new 'ScopeRequires' reports each scope's
dependencies. The service validates requested scopes through 'ScopeRequires'
and keeps only the labels and descriptions shown at authorization. We removed
the unused 'Requires' field from 'service.ScopeDefinition'.

We also noted in the README that the public package structure needs a rethink.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

jak merged commit a84c942634 into groups-capabilities

2026-10-20 16:03:30 -04:00

jak referenced this pull request

2026-10-20 16:55:42 -04:00

Issue every token to exactly one audience #7