No token revocation or blacklist

Mark commented

2026-05-10 16:06:53 +00:00

Owner

Closed: This feature belongs to a different project domain than tokengenerator.

Original request: Feature: Blacklist management for revoked or compromised tokens

Per triage review, this issue is misaligned with tokengenerator's project scope. Please re-file against the appropriate project.

Closed: This feature belongs to a different project domain than tokengenerator. **Original request:** Feature: Blacklist management for revoked or compromised tokens Per triage review, this issue is misaligned with tokengenerator's project scope. Please re-file against the appropriate project.

Mark added the

feature-request

label

2026-05-11 20:10:20 +00:00

Mark added

blocked:needs-decision

and removed

feature-request

labels

2026-05-14 13:22:15 +00:00

Mark commented

2026-05-14 13:22:16 +00:00

Author

Owner

Feature Triage Assessment

Scope: small
Risk: medium
Spec Alignment: misaligned
Summary: Wants to add a token revocation/blacklist system so issued tokens can be invalidated.
Recommendation: This issue stems from a category confusion: the project generates game token images (RPG tokens), not auth/API tokens. There is no token issuance system, no user auth, and the only credential is a single Google API key passed via env var. A revocation list doesn't correspond to anything in the project's architecture. Close as not applicable.
Rationale: The project is a visual game token generator — the term 'token' refers to game pieces (icons, circles with text). Issue #17 treats them as authentication/API tokens, which is completely misaligned with the project's purpose. No spec, plan, or architecture in the repo references token issuance, and the server.js has no auth middleware beyond the one env-var API key. This is a non-sequitur for this codebase.

Labeled blocked:needs-decision — unblock on Forgejo to dispatch to the fixer pipeline.

## Feature Triage Assessment **Scope:** small **Risk:** medium **Spec Alignment:** misaligned **Summary:** Wants to add a token revocation/blacklist system so issued tokens can be invalidated. **Recommendation:** This issue stems from a category confusion: the project generates game token images (RPG tokens), not auth/API tokens. There is no token issuance system, no user auth, and the only credential is a single Google API key passed via env var. A revocation list doesn't correspond to anything in the project's architecture. Close as not applicable. **Rationale:** The project is a visual game token generator — the term 'token' refers to game pieces (icons, circles with text). Issue #17 treats them as authentication/API tokens, which is completely misaligned with the project's purpose. No spec, plan, or architecture in the repo references token issuance, and the server.js has no auth middleware beyond the one env-var API key. This is a non-sequitur for this codebase. Labeled `blocked:needs-decision` — unblock on Forgejo to dispatch to the fixer pipeline.

Mark commented

2026-05-15 13:18:26 +00:00

Author

Owner

This treats token as an auth/API credential concept. tokengenerator generates visual game-piece images (SVG icons with text) — not cryptographic tokens. There is no token issuance system, no auth beyond a single Google API key, and nothing to revoke or analyze cryptographically. Closing as filed against the wrong repository.

Mark closed this issue

2026-05-15 13:18:26 +00:00

Rows
Columns

No token revocation or blacklist #17

Feature Triage Assessment