[fga] Introduce GitpodTokenService

[jeanp413]

Description

Summary generated by Copilot

🤖 Generated by Copilot at 64a3604

This pull request introduces a new server component, GitpodTokenService, to manage Gitpod tokens for API access. It also adds the corresponding permissions, read_tokens and write_tokens, to the Spicedb schema and the UserPermission type. The Gitpod server API methods related to Gitpod tokens are refactored to use the new service. Unit tests for the service are added as well.

Related Issue(s)

Fixes https://linear.app/gitpod/issue/EXP-420

Documentation

Preview status

gitpod:summary

Build Options

Build

• /werft with-werft
  Run the build with werft instead of GHA
• leeway-no-cache
• /werft no-test
  Run Leeway with --dont-test

Publish

• /werft publish-to-npm
• /werft publish-to-jb-marketplace

Installer

• analytics=segment
• with-dedicated-emulation
• workspace-feature-flags
  Add desired feature flags to the end of the line above, space separated

Preview Environment / Integration Tests

• /werft with-local-preview
  If enabled this will build install/preview
• /werft with-preview
• /werft with-large-vm
• /werft with-gce-vm
  If enabled this will create the environment on GCE infra
• with-integration-tests=all
  Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh. If enabled, with-preview and with-large-vm will be enabled.
• with-monitoring

/hold

[svenefftinge]

Thanks! As said in the comments, we need to keep the guardAccess calls in all server-impl methods.

[svenefftinge]

Thanks! This looks good now. Could you squash your commits and merge?

[jeanp413]

/unhold