Tracking Issue: Token Scopes

[Turbo87]

This is a tracking issue for the RFC "crates.io Token Scopes" (rust-lang/rfcs#2947).

Steps:

Backend:

• add token scopes to the database (database/api_tokens: Add crate_scopes and endpoint_scopes columns #5562)
• check token scopes for authenticated endpoints (Implement token scope restrictions for our endpoints #5572)
• implement API support for token scopes (Add crate_scopes and endpoint_scopes fields to the PUT /me/tokens API endpoint #5973 and GET /me/tokens: Add crate_scopes and endpoint_scopes fields #6310)

Frontend:

• create a dedicated token creation route (Add new settings/tokens/new page #6395)
• implement support for endpoint scopes to the route (settings/tokens/new: Add "Scopes" section #6428)
• implement support for crates scopes to the route (settings/tokens/new: Add "Crates" section #6432)
• show token scopes in the API token list (settings/tokens: Display endpoint/crate scopes if they exist #6450)

The exact details of these steps are still tbd. Feel free to discuss here or contact the @rust-lang/crates-io team if you have any questions. It might be best to discuss the plans first before working on and opening a PR 😉

Unresolved questions:

• Are there more scopes that would be useful to implement from the start?
• Is the current behavior of crate scopes on endpoints that don't interact with
  crates the best, or should a token with crate scopes prevent access to
  endpoints that don't act on crates?

[mbhall88]

Was there a reason for limiting the patterns allowed for token scope to, for example, serde*? What I mean is the wildcard is a suffix here, but *serde is not allowed - i.e., a wildcard prefix.

My use case is I have a workspace with binary foo and a library libfoo. I'd like to be able to create a crates API token scoped to *foo but his is not possible with the current scoping patterns.

(Apologies if this is not the right place to ask this question)

[Turbo87]

@mbhall88 mostly for implementation simplicity. you can add multiple scopes to one token though, so this should still be relatively easy to achieve.