{"record":{"id":"188bcabfd9f664f2","repo":"JuliusBrussee/caveman","slug":"githubapp-permission-q-q-exceeds-the-least-agen","errorCode":null,"errorMessage":"githubapp: permission %q=%q exceeds the least-agency allowlist","messagePattern":"githubapp: permission %q=%q exceeds the least-agency allowlist","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/githubapp/githubapp.go","lineNumber":202,"sourceCode":"// `repos` and `perms`, returning a ~1h token. Defaults (perms nil) are\n// contents:write + pull_requests:write — enough to push a branch and open a draft\n// PR, never to merge.\nfunc (a *App) MintInstallationToken(ctx context.Context, installationID int64, repos []string, perms map[string]string) (InstallationToken, error) {\n\tif installationID <= 0 {\n\t\treturn InstallationToken{}, fmt.Errorf(\"githubapp: installation id must be positive\")\n\t}\n\tif len(repos) != 1 || strings.TrimSpace(repos[0]) == \"\" {\n\t\treturn InstallationToken{}, fmt.Errorf(\"githubapp: exactly one repository is required\")\n\t}\n\trepository := strings.TrimSpace(repos[0])\n\tif perms == nil {\n\t\tperms = map[string]string{\"contents\": \"write\", \"pull_requests\": \"write\"}\n\t}\n\tallowedPermissions := map[string]bool{\"contents\": true, \"pull_requests\": true}\n\tscopedPermissions := make(map[string]string, len(perms))\n\tfor name, level := range perms {\n\t\tif !allowedPermissions[name] || (level != \"read\" && level != \"write\") {\n\t\t\treturn InstallationToken{}, fmt.Errorf(\"githubapp: permission %q=%q exceeds the least-agency allowlist\", name, level)\n\t\t}\n\t\tscopedPermissions[name] = level\n\t}\n\tjwt, err := a.AppJWT()\n\tif err != nil {\n\t\treturn InstallationToken{}, err\n\t}\n\tbody := map[string]any{\"permissions\": scopedPermissions, \"repositories\": []string{repository}}\n\tstatus, raw, err := a.do(ctx, \"Bearer \"+jwt, http.MethodPost,\n\t\t\"/app/installations/\"+strconv.FormatInt(installationID, 10)+\"/access_tokens\", body)\n\tif err != nil {\n\t\treturn InstallationToken{}, err\n\t}\n\tif status != http.StatusCreated {\n\t\treturn InstallationToken{}, fmt.Errorf(\"githubapp: mint token: HTTP %d: %s\", status, snippet(raw))\n\t}\n\tvar out InstallationToken\n\tif err := json.Unmarshal(raw, &out); err != nil {","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/githubapp/githubapp.go#L184-L220","documentation":"Least-privilege enforcement in MintInstallationToken(): a requested permission name or level is outside the allowlist (only known names with level read/write are accepted). This blocks minting tokens with broad or dangerous permissions (e.g. admin, delete) before any network call.","triggerScenarios":"Thrown at shared/platform/githubapp/githubapp.go:202 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Request only allowlisted permissions (e.g. contents, pull_requests) at read/write levels","Pass nil perms to accept the safe defaults (contents:write + pull_requests:write)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}