update capability permissions

[laurenleach]

No description provided.

[github-actions]

Claude finished @laurenleach's task in 1m 3s —— View job

---

PR Review: Update Capability Permissions

• Gather context
• Analyze changes
• Post review

---

This PR removes 5 specific admin.* sub-scopes from capability permissions across resource types, keeping only the top-level admin scope. This aligns with PR #80's finding that only the admin scope is needed (since it implies the admin.* sub-scopes).

Scopes removed:

• admin.users:read (from resourceTypeUser)
• admin.teams:read (from resourceTypeWorkspace)
• admin.usergroups:read (from resourceTypeUserGroup)
• admin.users:write (from resourceTypeGroup)
• admin.roles:read (from resourceTypeWorkspaceRole)

Issues to Address

1. baton_capabilities.json is out of sync ⚠️

This file is auto-generated via ./connector capabilities > baton_capabilities.json (per the CI workflow). It still contains all the removed admin.* scopes. The CI check in generate-baton-metadata.yaml will likely fail because the committed JSON doesn't match what the binary produces.

You'll need to regenerate this file:

go build ./cmd/baton-slack && ./baton-slack capabilities > baton_capabilities.json

Fix this →

2. README.md still lists removed scopes ⚠️

Lines 30-33 and 36 of README.md still document the specific admin.* scopes as required User Token Scopes. Since this PR's intent is that only admin is needed, the README should be updated to reflect that. PR #80 already updated docs/connector.mdx — the README should follow suit.

Fix this →

Code Changes Look Good

The changes to resource_types.go itself are clean and correct — each resource type that had both admin and a specific admin.* scope now only has admin. No logic changes, just scope cleanup.

---

[github-actions]

Claude finished @laurenleach's task in 59s —— View job

---

PR Review: Update Capability Permissions

• Gather context
• Analyze changes
• Post review

---

This PR removes 5 specific admin.* sub-scopes from capability permissions, keeping only the top-level admin scope. This aligns with PR #80's finding that the admin scope implies its sub-scopes.

Scopes removed from resource_types.go:

• admin.users:read (from resourceTypeUser)
• admin.teams:read (from resourceTypeWorkspace)
• admin.usergroups:read (from resourceTypeUserGroup)
• admin.users:write (from resourceTypeGroup)
• admin.roles:read (from resourceTypeWorkspaceRole)

Previous Issue Fixed

baton_capabilities.json is now in sync — The second commit (c0ca3e7) regenerated this file to match the updated code. The JSON now correctly reflects only the admin scope without the removed sub-scopes.

Remaining Issue

README.md still lists removed scopes ⚠️

Lines 29-36 of README.md still document the specific admin.* scopes as required:

  - admin
  - admin.roles:read
  - admin.teams:read
  - admin.usergroups:read
  - admin.users:read

For provisioning you will need this scope.
  - admin.users:write

Since this PR's intent is that only admin is needed (it implies the sub-scopes), the README should be updated to match. PR #80 already updated docs/connector.mdx — the README should follow suit.

Fix this →

Code Changes Look Good

The changes to resource_types.go are clean and correct — each resource type that previously listed both admin and a specific admin.* scope now only lists admin.

---

[github-actions]

Claude finished @laurenleach's task in 46s —— View job

---

PR Review: Update Capability Permissions

• Gather context
• Analyze changes
• Post review

---

This PR removes 5 specific admin.* sub-scopes from capability permissions, keeping only the top-level admin scope. This aligns with PR #80's finding that the admin scope implies its sub-scopes.

Scopes removed from resource_types.go:

• admin.users:read (from resourceTypeUser)
• admin.teams:read (from resourceTypeWorkspace)
• admin.usergroups:read (from resourceTypeUserGroup)
• admin.users:write (from resourceTypeGroup)
• admin.roles:read (from resourceTypeWorkspaceRole)

Previously Flagged Issues

baton_capabilities.json is now in sync — Fixed in commit c0ca3e7.

docs/connector.mdx updated — Fixed in commit 127d334, which also adds auto-generation markers and a missing note about Business+ account provisioning limitations.

Remaining Issue

README.md still lists removed scopes ⚠️

Lines 29-36 of README.md still document the specific admin.* sub-scopes as required:

  - admin
  - admin.roles:read
  - admin.teams:read
  - admin.usergroups:read
  - admin.users:read

For provisioning you will need this scope.
  - admin.users:write

Since this PR's intent is that only admin is needed (it implies the sub-scopes), the README should be updated to match. PR #80 already updated docs/connector.mdx — the README should follow suit.

Fix this →

Code Changes Look Good

The changes to resource_types.go are clean and correct — each resource type that previously listed both admin and a specific admin.* scope now only lists admin. The docs/connector.mdx updates are also good, adding auto-generation markers for the capabilities section.

---