rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Map ITAM actions to v1:itam OAuth2 scopes

Browse Source 
ITAM GraphQL actions were never registered in the shared OAuth2
scope registry, so bearer-token callers failed closed even when
role policies allowed them. Add v1:itam / v1:itam:read mappings,
register them in probod, and sync the CLI client scopes.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-07-30 11:13:28 +02:00
parent 7731566c68
commit 7bce67454c
5 changed files with 113 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/iam/oauth2_scope_registrations_test.go
View File

@@ -29,6 +29,7 @@ import (
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/iam/oauth2scope"
"go.probo.inc/probo/pkg/itam"
"go.probo.inc/probo/pkg/probo"
)
@@ -37,7 +38,8 @@ func allRegisteredOAuth2ScopeRegistries() *oauth2scope.Registry {
Register(iam.IAMOAuth2ScopeMappings).
Register(probo.OAuth2ScopeMappings).
Register(accessreview.OAuth2ScopeMappings).
Register(agentrun.OAuth2ScopeMappings)
Register(agentrun.OAuth2ScopeMappings).
Register(itam.OAuth2ScopeMappings)
}
func TestRegisteredOAuth2ScopeRegistries_OrganizationRead(t *testing.T) {
@@ -62,3 +64,13 @@ func TestRegisteredOAuth2ScopeRegistries_UnmappedActionDenies(t *testing.T) {
assert.False(t, reg.Allows(tokenScopes, "core:unmapped:action"))
}
func TestRegisteredOAuth2ScopeRegistries_ITAMDeviceDelete(t *testing.T) {
t.Parallel()
reg := allRegisteredOAuth2ScopeRegistries()
assert.True(t, reg.Allows(coredata.OAuth2Scopes{itam.ScopeV1ITAM}, itam.ActionDeviceDelete))
assert.False(t, reg.Allows(coredata.OAuth2Scopes{itam.ScopeV1ITAMRead}, itam.ActionDeviceDelete))
assert.True(t, reg.Allows(coredata.OAuth2Scopes{itam.ScopeV1ITAMRead}, itam.ActionDeviceGet))
}