Add read actions to all unprefixed scopes

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/iam/oauth2/cimd.go

@@ -400,7 +400,7 @@ func (s *Service) upsertCIMDClient(
 		clientURI = &doc.ClientURI
 	}
 
-	scopes := coredata.OAuth2Scopes(authorizationServerScopes(s.registry.RegisteredScopes()))
+	scopes := coredata.OAuth2Scopes(authorizationServerScopes(s.registry.AllWriteScopes()))
 
 	now := time.Now()
 

pkg/iam/oauth2_scopes.go

@@ -49,6 +49,30 @@ var IAMOAuth2ScopeMappings = map[coredata.OAuth2Scope][]string{
 		ActionOAuth2AccessTokenList,
 	},
 	ScopeV1IAM: {
+		ActionOrganizationGet,
+		ActionOrganizationList,
+		ActionIdentityGet,
+		ActionSessionList,
+		ActionSessionGet,
+		ActionInvitationList,
+		ActionInvitationGet,
+		ActionMembershipGet,
+		ActionMembershipList,
+		ActionMembershipProfileGet,
+		ActionMembershipProfileList,
+		ActionPersonalAPIKeyGet,
+		ActionPersonalAPIKeyList,
+		ActionSAMLConfigurationGet,
+		ActionSAMLConfigurationList,
+		ActionSCIMConfigurationGet,
+		ActionSCIMEventList,
+		ActionSCIMEventGet,
+		ActionSCIMBridgeGet,
+		ActionOAuth2ConsentGet,
+		ActionAuditLogEntryGet,
+		ActionAuditLogEntryList,
+		ActionOAuth2AccessTokenGet,
+		ActionOAuth2AccessTokenList,
 		ActionOrganizationCreate,
 		ActionOrganizationUpdate,
 		ActionOrganizationDelete,

pkg/iam/oauth2scope/registry.go

@@ -60,6 +60,20 @@ func (r *Registry) RegisteredScopes() []coredata.OAuth2Scope {
 	return sortedScopes(slices.Collect(maps.Keys(r.scopeActions)))
 }
 
+func (r *Registry) AllWriteScopes() []coredata.OAuth2Scope {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	writeScopes := make([]coredata.OAuth2Scope, 0, len(r.scopeActions))
+	for scope := range r.scopeActions {
+		if !scope.IsRead() {
+			writeScopes = append(writeScopes, scope)
+		}
+	}
+
+	return sortedScopes(writeScopes)
+}
+
 func (r *Registry) Allows(tokenScopes coredata.OAuth2Scopes, action string) bool {
 	r.mu.RLock()
 	defer r.mu.RUnlock()

pkg/iam/oauth2scope/registry_test.go

@@ -105,6 +105,25 @@ func TestRegistry_ScopesForAction(t *testing.T) {
 	assert.Nil(t, reg.ScopesForAction("core:organization:delete"))
 }
 
+func TestRegistry_AllWriteScopes(t *testing.T) {
+	t.Parallel()
+
+	const (
+		scopeV1OrgRead  = coredata.OAuth2Scope("v1:org:read")
+		scopeV1OrgWrite = coredata.OAuth2Scope("v1:org")
+	)
+
+	reg := oauth2scope.NewRegistry().
+		Register(
+			map[coredata.OAuth2Scope][]string{
+				scopeV1OrgWrite: {"core:organization:update"},
+				scopeV1OrgRead:  {"core:organization:get"},
+			},
+		)
+
+	assert.Equal(t, []coredata.OAuth2Scope{scopeV1OrgWrite}, reg.AllWriteScopes())
+}
+
 func TestRegistry_RegisteredScopes(t *testing.T) {
 	t.Parallel()