token-based owner invite accept API

[Mark-Simulacrum]

For rust-lang (and presumably other orgs), we want all of the crates "owned" by the project to have access by the rust-lang-owner bot account. When crates are created by other users and we want to move them into the org, it currently requires a human to go through github login for the rust-lang-owner account and click through the UI to accept an invite from existing owners. This is a relatively painful process and has to be done by someone with full access to the account.

Can we add and/or extend the existing token-based auth to allow accepting invites with just an API token?

[Turbo87]

the PUT /api/v1/me/crate_owner_invitations/accept/:token API endpoint works without any authentication and only needs the invitation token from the corresponding invite email. seems like that should be sufficient for potential automation?

[Mark-Simulacrum]

Hm, interesting. Receiving the email in an automated fashion is painful, but we can call that manually... is it documented that this isn't an authenticated API? I guess the token embeds username and such?

[Turbo87]

I guess the token embeds username and such?

yeah, the token is the connection between invited user and the crate, so auth doesn't matter for this endpoint

is it documented that this isn't an authenticated API?

I don't think we currently have any documented API at all... except for the protocol between cargo and crates.io