[api-docs]: mark bypass-2FA GATs as forbidden for account/governance writes#70
Open
shmam wants to merge 4 commits into
Open
[api-docs]: mark bypass-2FA GATs as forbidden for account/governance writes#70shmam wants to merge 4 commits into
shmam wants to merge 4 commits into
Conversation
Refs github/npm#15356 (parent: github/npm#15226). Granular Access Tokens created with bypass_2fa: true can no longer perform account-identity or org/team/package governance write operations. Direct publish remains allowed (removal tracked in #15256). Changes: - Add shared Forbidden2FABypassGAT (403) response component and expand the Authentication section to describe the capability boundary and list affected operations. - Update the bypass_2fa field description on POST /-/npm/v1/tokens and its response schemas to enumerate the reduced surface. - Add a requirement note and 403 response to each affected endpoint: - POST /-/npm/v1/tokens - DELETE /-/npm/v1/tokens/token/{token} - POST /-/package/{package}/access - PUT /-/team/{orgName}/{teamName}/package - DELETE /-/team/{orgName}/{teamName}/package - PUT /-/org/{orgName}/user - DELETE /-/org/{orgName}/user - PUT /-/org/{orgName}/team - DELETE /-/org/{orgName}/{teamName} - PUT /-/org/{orgName}/{teamName}/user - DELETE /-/org/{orgName}/{teamName}/user - POST /-/package/{package}/trust - DELETE /-/package/{package}/trust/{config-uuid} Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5b64e0a1-d9ff-4710-af56-5c47499cfb28
|
🚀 Preview deployed! You can view the preview of your changes here: https://npm-71689ab9a5-61146453.drafts.github.io/ This preview will be updated automatically when you push new commits to this PR. |
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5b64e0a1-d9ff-4710-af56-5c47499cfb28
|
🚀 Preview deployed! You can view the preview of your changes here: https://npm-71689ab9a5-61146453.drafts.github.io/ This preview will be updated automatically when you push new commits to this PR. |
|
🚀 Preview deployed! You can view the preview of your changes here: https://npm-71689ab9a5-61146453.drafts.github.io/ This preview will be updated automatically when you push new commits to this PR. |
nishantms
reviewed
Jul 21, 2026
nishantms
reviewed
Jul 21, 2026
shmam
changed the title
- Add npmAccessToken and granularAccessToken to security blocks on
endpoints that added a bypass-2FA GAT 403, so the 403 is reachable
under the spec (token create/delete, access/team-package grant/revoke
and set-access, org member add/remove, team create/delete and
member add/remove).
- Trust 403: allow both 'error' and 'message' body shapes and switch
the bypass_2fa_gat example to 'error' to match the auth-layer
denial shape used by the shared Forbidden2FABypassGAT component.
Update DELETE trust 403 description to include bypass-2FA GAT case
for parity with POST.
- Shared Forbidden2FABypassGAT: trim trailing space and make the
description specific.
- base.yaml: reference the access endpoint with {escapedPackageName}
to match access.yaml.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5b64e0a1-d9ff-4710-af56-5c47499cfb28
|
🚀 Preview deployed! You can view the preview of your changes here: https://npm-71689ab9a5-61146453.drafts.github.io/ This preview will be updated automatically when you push new commits to this PR. |
nishantms
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents that Granular Access Tokens created with
bypass_2fa: truecan no longer perform account-identity or org/team/package governance write operations. Direct publish (PUT /{escapedPackageName}) remains functional for such tokens.Changes
api/shared-components.yaml— new reusableForbidden2FABypassGAT(403) response component.api/base.yaml— expand the Authentication & Authorization section to describe the bypass-2FA GAT capability boundary and enumerate the affected endpoints; update thenpmAccessToken/granularAccessTokensecurity scheme descriptions.api/registry.npmjs.com/token.yaml— expand thebypass_2farequest/response field descriptions to enumerate the reduced capability surface.403response to each affected endpoint documented in this repo:POST /-/npm/v1/tokensDELETE /-/npm/v1/tokens/token/{token}POST /-/package/{package}/accessPUT /-/team/{orgName}/{teamName}/packageDELETE /-/team/{orgName}/{teamName}/packagePUT /-/org/{orgName}/userDELETE /-/org/{orgName}/userPUT /-/org/{orgName}/teamDELETE /-/org/{orgName}/{teamName}PUT /-/org/{orgName}/{teamName}/userDELETE /-/org/{orgName}/{teamName}/userPOST /-/package/{package}/trust(extends existing 403 with abypass_2fa_gatexample)DELETE /-/package/{package}/trust/{config-uuid}(same)