Support Gitlab's fine grained access tokens (`Access denied: This operation doesn't support fine-grained personal access tokens`)

[olivierdalang]

Hey ! Thanks for this awesome project, got it running in no time and it works great !

Unfortunately, it seems gitlab fine grained access tokens are not yet supported. On gitlab.com, fine grained token are advertised as beta, but full access personal tokens are already advertized as legacy. For reference, it works flawlessly with github's fine grained tokens.

After a little bit of trial and error (the gitlab API being nice enough to say which permissions were missing), I ended up with the set of permissions below. But still I cannot login with this screen:

I attached the response of the server below (to a POST to https://gitlab.com/api/graphql). This time it seems it's not a missing scope in the token... I used version https://unpkg.com/@sveltia/cms@0.164.1/dist/sveltia-cms.js.

In the meantime, maybe it's worth clarifying in the docs that fine grained token are not yet supported, and once supported, it would be helpful to document the permissions to include in the token (as it's not easy to guess).

Thanks again !

Olivier

---

Permissions

• Group and project permissions
  • System Access
    • Member: Update, Read, Delete, Create
  • Groups
    • Member Role: Read, Delete, Create
  • Repository
    • Commit: Update, Read, Delete, Create
    • Code: Read, Push, Download
    • Branch: Read, Protect, Delete, Create
    • Repository: Read
  • Projects
    • Project: Read
• User permissions
  • System Access
    • User: Read

---

Response

{
    "errors": [
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                0,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                1,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                2,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                3,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                4,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                5,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                6,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                7,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                8,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                9,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                10,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                11,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                12,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                13,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                14,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                15,
                "type"
            ]
        },
        {
            "message": "Access denied: This operation doesn't support fine-grained personal access tokens.",
            "locations": [
                {
                    "line": 1,
                    "column": 176
                }
            ],
            "path": [
                "project",
                "repository",
                "tree",
                "blobs",
                "nodes",
                16,
                "type"
            ]
        }
    ],
    "data": {
        "project": {
            "repository": {
                "tree": {
                    "blobs": {
                        "nodes": [
                            null,
                            null,
                            null,
                            null,
                            null,
                            null,
                            null,
                            null,
                            null,
                            null,
                            null,
                            null,
                            null,
                            null,
                            null,
                            null,
                            null
                        ],
                        "pageInfo": {
                            "endCursor": "MTc",
                            "hasNextPage": false
                        }
                    }
                }
            }
        }
    }
}

[kyoshino]

Thank you for your report. However, I think the issue is on the GitLab side. We don’t support legacy or fine-grained PATs specifically. A quick search on GitLab finds this open merge request:

• Remove field-level gPAT directives from resolver-based Query fields

[kyoshino]

Let’s keep an eye on the merge request. If the error persists even after it’s merged and shipped, we should report it to GitLab.

[kyoshino]

I’m closing this issue because the errors are likely not fixable on our end. Will reopen it if any changes are needed to our API calls.