rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix advertised scopes for oauth protected resources

Browse Source 
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-06-25 10:21:47 +02:00
parent 38b6bbf4b5
commit 2ba8464d4e
6 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
contrib/claude/authorization.md
View File

@@ -289,7 +289,7 @@ Scopes are namespace- or product-level only — no resource segments (e.g. `v1:p
**Discovery:**
- Authorization server (RFC 8414): `scopes_supported` on `/.well-known/oauth-authorization-server` lists OIDC + all API scopes; `protected_resources` links to the resource metadata document
- Protected resource (RFC 9728): `scopes_supported` on `/.well-known/oauth-protected-resource` lists `openid` plus API scopes
- Protected resource (RFC 9728): `scopes_supported` on `/.well-known/oauth-protected-resource` lists `openid` plus write API scopes only (no `:read` suffix); matches CIMD client registration
**Enforcement:** OAuth2 bearer-token requests carry the validated access token on the request context (`pkg/iam/oauth2/request_context.go`). Before IAM policy evaluation, `iam.Authorizer` checks registered `oauth2scope.Registry` mappings via `Registry.Allows`. Each domain package exports `OAuth2ScopeMappings` in its `oauth2_scopes.go`; `probod` registers all domain mappings on the shared registry before `iam.NewService`. The check uses explicit scope→action lists — no `:read` / `:get` heuristics at enforcement time. Session, personal API key, and SCIM auth skip the check (no access token on context). Unmapped IAM actions **deny** OAuth requests (fail closed). Enforcement reads scopes from the access token directly.

3
e2e/console/oauth2_test.go
View File

@@ -114,7 +114,8 @@ func TestOAuth2_ProtectedResourceMetadata(t *testing.T) {
assert.Contains(t, metadata.AuthorizationServers, expectedResource)
assert.Contains(t, metadata.BearerMethodsSupported, "header")
assert.Contains(t, metadata.ScopesSupported, "openid")
assert.Contains(t, metadata.ScopesSupported, "v1:document:read")
assert.Contains(t, metadata.ScopesSupported, "v1:document")
assert.NotContains(t, metadata.ScopesSupported, "v1:document:read")
assert.NotContains(t, metadata.ScopesSupported, "profile")
}

4
pkg/iam/oauth2/protected_resource_metadata.go
View File

@@ -31,7 +31,7 @@ type ProtectedResourceMetadata struct {
func NewProtectedResourceMetadata(
resource uri.URI,
authorizationServer uri.URI,
registeredScopes []coredata.OAuth2Scope,
writeScopes []coredata.OAuth2Scope,
) *ProtectedResourceMetadata {
return &ProtectedResourceMetadata{
Resource: resource,
@@ -39,6 +39,6 @@ func NewProtectedResourceMetadata(
BearerMethodsSupported: []string{
"header",
},
ScopesSupported: protectedResourceScopes(registeredScopes),
ScopesSupported: protectedResourceScopes(writeScopes),
}
}

6
pkg/iam/oauth2/protected_resource_metadata_test.go
View File

@@ -32,19 +32,21 @@ func TestNewProtectedResourceMetadata(t *testing.T) {
reg := oauth2scope.NewRegistry().Register(
map[coredata.OAuth2Scope][]string{
probo.ScopeV1DocumentRead: {"core:document:get"},
probo.ScopeV1Document: {"core:document:create"},
},
)
resource := uri.URI("https://app.example.com")
authorizationServer := uri.URI("https://app.example.com")
metadata := oauth2.NewProtectedResourceMetadata(resource, authorizationServer, reg.RegisteredScopes())
metadata := oauth2.NewProtectedResourceMetadata(resource, authorizationServer, reg.AllWriteScopes())
require.NotNil(t, metadata)
assert.Equal(t, resource, metadata.Resource)
assert.Equal(t, []uri.URI{authorizationServer}, metadata.AuthorizationServers)
assert.Equal(t, []string{"header"}, metadata.BearerMethodsSupported)
assert.Contains(t, metadata.ScopesSupported, oauth2.ScopeOpenID)
assert.Contains(t, metadata.ScopesSupported, probo.ScopeV1DocumentRead)
assert.Contains(t, metadata.ScopesSupported, probo.ScopeV1Document)
assert.NotContains(t, metadata.ScopesSupported, probo.ScopeV1DocumentRead)
assert.NotContains(t, metadata.ScopesSupported, oauth2.ScopeProfile)
}

4
pkg/iam/oauth2/scopes.go
View File

@@ -32,9 +32,9 @@ func authorizationServerScopes(registeredScopes []coredata.OAuth2Scope) []coreda
)
}
func protectedResourceScopes(registeredScopes []coredata.OAuth2Scope) []coredata.OAuth2Scope {
func protectedResourceScopes(writeScopes []coredata.OAuth2Scope) []coredata.OAuth2Scope {
return slices.Concat(
[]coredata.OAuth2Scope{ScopeOpenID},
registeredScopes,
writeScopes,
)
}

2
pkg/iam/service.go
View File

@@ -233,7 +233,7 @@ func (s *Service) OAuth2ServerMetadata(endpoints oauth2.Endpoints) *oauth2.Serve
// OAuth2ProtectedResourceMetadata returns the RFC 9728 protected resource metadata document.
func (s *Service) OAuth2ProtectedResourceMetadata(resource uri.URI) *oauth2.ProtectedResourceMetadata {
return oauth2.NewProtectedResourceMetadata(resource, resource, s.OAuth2ScopeRegistry.RegisteredScopes())
return oauth2.NewProtectedResourceMetadata(resource, resource, s.OAuth2ScopeRegistry.AllWriteScopes())
}
func (s *Service) IsSignUpEnabled() bool {