auth: document opt-in scopes for api-keys, app-keys, service-accounts, org-group | DAL-958 DAL-973 - #702
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dad773cef6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…, org-group | DAL-958 DAL-973
bdb3449 to
cfc9724
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cfc9724b6f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
list --all only calls the org-wide read (list_application_keys); nothing in pup uses the org-wide write/delete/update endpoints (those are all current_user-scoped, gated by user_app_keys instead). Requesting write unnecessarily grants more than the command needs. Also trims a stale historical comment in commands::api's test.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fb5925f213
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Summary
api-keys,app-keys, andusers service-accountsall already send the OAuth bearer viamake_api!, but their required scopes (api_keys_read/write/delete,user_app_keys,org_app_keys_read,service_account_write) aren't indefault_scopes().organizationspolicies/policy-overrides/policy-configs subcommands needorg_group_read/org_group_write, also not indefault_scopes().AUTHENTICATIONhelp block using the same--extra-scopesopt-in pattern already used forlogs-restriction/data-deletion/datasets.cfg.validate_api_and_app_keys()?hard-block onapp-keys list --all. The org-wide endpoint already accepts OAuth server-side (gated byorg_app_keys_read); the block was stale and contradicted the AUTHENTICATION doc, which already claimed OAuth2 capability for it. Removed the now-deadvalidate_api_and_app_keyshelper (this was its only call site)./api/v2/api_keysand/api/v2/application_keysfromOAUTH_EXCLUDED_ENDPOINTS(src/raw_client.rs). Both paths already accept OAuth server-side, but these entries were still forcing the genericpup apipassthrough command to use API+App key auth on them even with a bearer token present. Updated the two tests that used these paths as "still excluded" examples to use Fleet Automation instead, since it remains genuinely excluded today (not a claim it's meant to stay that way).docs/EXTENSIONS.mdexample that cited/api/v2/api_keysas a guaranteed-fallback endpoint (no longer true after the above); genericized the wording instead of naming other examples likely to change too.Test plan
cargo buildsucceeds, no warningscargo fmt --checkcleancargo clippy --bin pup --no-depscleancargo test --bin pup raw_client:: commands::api:: config::passes (one pre-existing unrelated failure,test_from_env_default_site_when_no_org, reproduces onmaintoo -- missing tokio runtime in that test, not touched by this PR)--helpoutput forapi-keys,app-keys,users,organizations--extra-scopes:api-keys list/create/delete-- created and deleted a throwaway keyapp-keys list/create/delete-- created and deleted a throwaway keyapp-keys list --all-- confirmed working over OAuth (org_app_keys_read)users service-accounts create-- created a throwaway service account, then disabled itusers service-accounts app-keys list/create/delete-- created and deleted a throwaway app key on that service accountorganizations policies list-- confirmed working withorg_group_read/org_group_write