feat(perms): log all permissions and access #41

avivkeller · 2025-09-10T01:06:31Z

Fixes #4
Fixes #21

cc @nodejs/web @nodejs/security-wg - Feel free to modify this file with additional permissions and/or changes

Copilot

Pull Request Overview

This PR creates a comprehensive permissions documentation file that maps access levels for repositories, external services, and access tokens across different Node.js web teams and roles.

Introduces a structured permissions matrix documenting access levels for 9 repositories across 5 different team roles
Documents external service permissions for 7 services including Cloudflare, Vercel, and Sentry
Creates an access tokens section tracking service account credentials and their permissions

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

PERMISSIONS.md

avivkeller · 2025-09-10T01:06:47Z

I added everything I am aware of, however, there may be inaccuracies

AugustinMauroy

Missing piece:

npm publish oidc (I think it's owned by tsc)
maybe not in this doc but it's "related" list which npm package we publish.

AugustinMauroy · 2025-09-10T09:27:02Z

PERMISSIONS.md

@@ -0,0 +1,52 @@
+# Permissions
+


We should add small paragraphs that said "here all thing related to website part and who have acces to it"

PERMISSIONS.md

AugustinMauroy · 2025-09-10T09:32:28Z

Btw thanks aviv to tackle it 🫶🏻

PERMISSIONS.md

flakey5 · 2025-09-12T20:35:03Z

PERMISSIONS.md

+| **[Figma Design File][]** | Read     | -           | Write                  | -                 | -                  | Access to this service is controlled by the OpenJS Foundation and @avivkeller.                                             |
+| **[Sentry][]**            | -        | -           | -                      | Admin             | Admin              |                                                                                                                            |
+| **[Vercel][]**            | -        | -           | -                      | Admin             | Admin              |                                                                                                                            |
+


@ovflowd what would the permissions be for hackmd?

Right now @bmuenzenmeyer and me are admins, but technically speaking as being owned by the Foundation, I'm not sure how administration should be laid out. Probably only the to the Foundation Staff/IT?

cc @bensternthal if you have any ideas how this should be laid out.

ovflowd · 2025-09-13T15:43:27Z

PERMISSIONS.md

+| **[Sentry][]**            | -        | -           | -                      | Admin             | Admin              |                                                                                                                            |
+| **[Vercel][]**            | -        | -           | -                      | Admin             | Admin              |                                                                                                                            |
+
+## Access Tokens


Aren't there more tokens out there?

PERMISSIONS.md

ovflowd · 2025-09-13T15:46:59Z

PERMISSIONS.md

+
+## External Services
+
+| Service                   | Everyone | @nodejs/web | @nodejs/nodejs-website | @nodejs/web-infra | @nodejs/web-admins | Notes                                                                                                                      |


Crowdin is missing here. Access is done through a shared account

I thought crowdin wasn't a shared account for infra, and they used their own logins?

MattIPv4 · 2025-09-15T14:11:44Z

PERMISSIONS.md

+| Service                      | Everyone                           | @nodejs/web | @nodejs/nodejs-website | @nodejs/web-infra | @nodejs/web-admins | Notes                                                                                                                        |
+| ---------------------------- | ---------------------------------- | ----------- | ---------------------- | ----------------- | ------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
+| **[1Password][]**            | -                                  | -           | -                      | Admin             | Admin              |                                                                                                                              |
+| **[Atlassian Statuspage][]** | [Read](https://status.nodejs.org/) | -           | -                      | Admin             | Admin              |


MattIPv4 · 2025-09-15T14:17:30Z

PERMISSIONS.md

+
+| Secret Name                | Display Name            | Platform(s) / Location(s)                                              | Associated Project(s)                     | Access Level | Expiry | Notes                                       |
+| -------------------------- | ----------------------- | ---------------------------------------------------------------------- | ----------------------------------------- | ------------ | ------ | ------------------------------------------- |
+| `CF_API_TOKEN`             | N/A                     | [nodejs/discord-status-worker][], [nodejs/release-cloudflare-worker][] | [Cloudflare][]                            | Write        | -      | Used for deploying to Cloudflare Wrangler   |


MattIPv4 · 2025-09-15T14:18:46Z

PERMISSIONS.md

+[@openjs-vercel]: https://github.com/openjs-vercel
+[Atlassian Statuspage]: https://manage.statuspage.io/pages/rxy2rhgm8q1n/incidents
+[Chromatic]: https://www.chromatic.com/builds?appId=64c7d71358830e9105808652
+[Cloudflare]: https://www.cloudflare.com/


Suggested change

[Cloudflare]: https://www.cloudflare.com/

[Cloudflare]: https://dash.cloudflare.com/07be8d2fbc940503ca1be344714cb0d1

feat(perms): log all permissions and access

cd5e959

Copilot AI review requested due to automatic review settings September 10, 2025 01:06

avivkeller requested a review from a team as a code owner September 10, 2025 01:06

Copilot AI reviewed Sep 10, 2025

View reviewed changes

PERMISSIONS.md Outdated Show resolved Hide resolved

PERMISSIONS.md Outdated Show resolved Hide resolved

PERMISSIONS.md Outdated Show resolved Hide resolved

consistent dashes

1cc6db1

AugustinMauroy reviewed Sep 10, 2025

View reviewed changes

flakey5 reviewed Sep 10, 2025

View reviewed changes

PERMISSIONS.md Outdated Show resolved Hide resolved

Revise permissions and access notes in PERMISSIONS.md

088aea0

avivkeller mentioned this pull request Sep 11, 2025

doc: add web-team IRP #42

Open

avivkeller added 2 commits September 11, 2025 08:18

Update permissions and access tokens in documentation

cc572d5

fixup!

c481bf9

MattIPv4 reviewed Sep 12, 2025

View reviewed changes

PERMISSIONS.md Show resolved Hide resolved

PERMISSIONS.md Show resolved Hide resolved

flakey5 reviewed Sep 12, 2025

View reviewed changes

ovflowd reviewed Sep 13, 2025

View reviewed changes

PERMISSIONS.md Outdated Show resolved Hide resolved

ovflowd reviewed Sep 13, 2025

View reviewed changes

avivkeller added 4 commits September 14, 2025 14:54

add crowdin, status, vercel

f07af7b

add read link for status page

965036b

fixup!

54be795

vercel shared

7fb3332

MattIPv4 reviewed Sep 15, 2025

View reviewed changes


		## External Services

		\| Service \| Everyone \| @nodejs/web \| @nodejs/nodejs-website \| @nodejs/web-infra \| @nodejs/web-admins \| Notes \|

	\| [Atlassian Statuspage][] \| [Read](https://status.nodejs.org/) \| - \| - \| Admin \| Admin \|
	\| [Atlassian Statuspage][] \| [Read](https://status.nodejs.org/) \| - \| - \| App Admin \| Org Admin \|

	\| `CF_API_TOKEN` \| N/A \| [nodejs/discord-status-worker][], [nodejs/release-cloudflare-worker][] \| [Cloudflare][] \| Write \| - \| Used for deploying to Cloudflare Wrangler \|
	\| `CF_API_TOKEN` \| N/A \| [nodejs/discord-status-worker][], [nodejs/release-cloudflare-worker][] \| [Cloudflare][] \| Write \| - \| Used for deploying to Cloudflare Workers \|

	[Cloudflare]: https://www.cloudflare.com/
	[Cloudflare]: https://dash.cloudflare.com/07be8d2fbc940503ca1be344714cb0d1

Uh oh!

feat(perms): log all permissions and access #41

Are you sure you want to change the base?

feat(perms): log all permissions and access #41

Uh oh!

Conversation

avivkeller commented Sep 10, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

avivkeller commented Sep 10, 2025

Uh oh!

AugustinMauroy left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AugustinMauroy commented Sep 10, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MattIPv4 Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

MattIPv4 Sep 15, 2025 •

edited

Loading