rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Request Brex companies.readonly scope for name resolution

Browse Source 
The Brex name resolver calls GET /v2/company to build the source
display name, but the connector only requested openid, offline_access,
and users.readonly -- and users.readonly covers /v2/users (the account
fetch), not /v2/company. So the company endpoint 403'd for every Brex
source, which the source-name worker retried forever (2.9M errors in 7
days) until the terminal-error handling stopped the loop.

Add companies.readonly so the endpoint resolves. Verified as the exact
scope string against Brex's OAuth authorize flow (the "Companies: Read
only" developer scope maps to companies.readonly). Existing Brex
connectors must reconnect to re-consent to the added scope; until they
do, /v2/company still 403s but is now handled cleanly (terminal ->
generic name, no loop) rather than silently retried.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-07-22 13:15:53 +02:00
parent c837701099
commit c50d2657f4
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
pkg/connector/provider/brex.go
View File

@@ -31,12 +31,16 @@ import (
func brexRegistration() *Registration {
return &Registration{
Provider: coredata.ConnectorProviderBrex,
DisplayName: "Brex",
AuthURL: "https://accounts-api.brex.com/oauth2/default/v1/authorize",
TokenURL: "https://accounts-api.brex.com/oauth2/default/v1/token",
ProbeURL: "https://platform.brexapis.com/v2/users/me",
OAuth2Scopes: []string{"openid", "offline_access", "users.readonly"},
Provider: coredata.ConnectorProviderBrex,
DisplayName: "Brex",
AuthURL: "https://accounts-api.brex.com/oauth2/default/v1/authorize",
TokenURL: "https://accounts-api.brex.com/oauth2/default/v1/token",
ProbeURL: "https://platform.brexapis.com/v2/users/me",
// companies.readonly is required by the name resolver's GET /v2/company
// call; without it Brex 403s that endpoint (users.readonly covers only
// /v2/users, which the driver uses). Existing Brex connectors must
// reconnect to re-consent to the added scope.
OAuth2Scopes: []string{"openid", "offline_access", "users.readonly", "companies.readonly"},
SupportsAPIKey: true,
NewDriver: func(_ context.Context, c *http.Client, _ *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
return drivers.NewBrexDriver(c), nil