I'm unsure about the use of permission units. I may want to reduce scope to access tokens only. And it seems that tokenRequiresScopes is orthogonal to reqRepoWriter.

@lafriks, I want to implement this in a way, that write:repo should be sufficient to write to commit status. write:commitstatus should be contained within write:repo permission. This change should enable tokens with more granular scope.

So commitstatus is shown in the UI. I can create tokens with write:commitstatus. But I'm unable to write with only write:repo. So it is indeed breaking at this moment.

{"message":"token does not have at least one of required scope(s), required=[write:commitstatus write:repository], token scope=write:repository","url":"http://localhost:3000/api/swagger"}