Project access tokens do not require a scope, leading to all options checked if none are checked.
<!--IssueSummary start--> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Work on this issue](https://contributors.gitlab.com/manage-issue?action=work&projectId=278964&issueIid=343464) - [Close this issue](https://contributors.gitlab.com/manage-issue?action=close&projectId=278964&issueIid=343464) </details> <!--IssueSummary end--> ## Issue If you create a project access token, then ignore the `Scope` selection, the response is that all options are selected. Presumably the response that should be no options are activated, yielding an account that is read only. ![Screen_Shot_2021-10-20_at_7.44.30_PM](/uploads/06f59251b443510c300bf65072218ce5/Screen_Shot_2021-10-20_at_7.44.30_PM.png) #### Concerns - Should there be a warning that no scopes selected would yield a read only access token? - Should the form throw a validation error stating that scopes cannot be blank. ## Proposal 1. update documentation 2. update setting helper text: - **Select scopes** - `Scopes set the permission levels granted to the token. [Learn more](.../help/user/project/settings/project_access_tokens). By default, access tokens are granted read-only access to the project. You can also add the following additional permissions:` Final proposal: https://gitlab.com/gitlab-org/gitlab/-/issues/343464#note_869010774 CC: @cynthia @hsutor
issue