rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Introduce oauth2scope registry with freeze lifecycle

Browse Source 
Replace pkg/iam/scopeset with pkg/iam/oauth2scope.Registry, a shared
OAuth2 scope→action registry used by the authorizer, OAuth2 service,
and Connect API. Registration stays open until probod calls Freeze();
read paths (RegisteredScopes, Allows, ValidateScopes) panic before
that.

Drop the leaky APIScopes surface and AllowedAPIScopes on manual
access-token creation in favor of registry.ValidateScopes. Metadata,
protected-resource metadata, and CIMD scope lists are built from
RegisteredScopes() via helpers in pkg/iam/oauth2/scopes.go. Expose
oauth2ScopesSupported as an OAuth2Scope GraphQL scalar.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-06-20 18:17:40 +02:00
parent 0d33750735
commit c93932f026
27 changed files with 310 additions and 235 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/iam/oauth2/cimd.go
View File

@@ -400,15 +400,7 @@ func (s *Service) upsertCIMDClient(
clientURI = &doc.ClientURI
}
scopes := slices.Concat(
[]coredata.OAuth2Scope{
ScopeOpenID,
ScopeProfile,
ScopeEmail,
ScopeOfflineAccess,
},
s.scopeSet.APIScopes(),
)
scopes := coredata.OAuth2Scopes(authorizationServerScopes(s.registry.RegisteredScopes()))
now := time.Now()

16
pkg/iam/oauth2/metadata.go
View File

@@ -15,8 +15,6 @@
package oauth2
import (
"slices"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/uri"
)
@@ -61,7 +59,7 @@ type (
}
)
func NewMetadata(issuer uri.URI, endpoints Endpoints, apiScopes []coredata.OAuth2Scope) *ServerMetadata {
func NewMetadata(issuer uri.URI, endpoints Endpoints, registeredScopes []coredata.OAuth2Scope) *ServerMetadata {
return &ServerMetadata{
Issuer: issuer,
AuthorizationEndpoint: endpoints.Authorization,
@@ -72,16 +70,8 @@ func NewMetadata(issuer uri.URI, endpoints Endpoints, apiScopes []coredata.OAuth
IntrospectionEndpoint: endpoints.Introspection,
RevocationEndpoint: endpoints.Revocation,
DeviceAuthorizationEndpoint: endpoints.DeviceAuthorization,
ScopesSupported: slices.Concat(
[]coredata.OAuth2Scope{
ScopeOpenID,
ScopeProfile,
ScopeEmail,
ScopeOfflineAccess,
},
apiScopes,
),
ProtectedResources: []uri.URI{issuer},
ScopesSupported: authorizationServerScopes(registeredScopes),
ProtectedResources: []uri.URI{issuer},
ResponseTypesSupported: []coredata.OAuth2ResponseType{
coredata.OAuth2ResponseTypeCode,
},

11
pkg/iam/oauth2/metadata_test.go
View File

@@ -22,6 +22,7 @@ import (
"github.com/stretchr/testify/require"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/iam/oauth2"
"go.probo.inc/probo/pkg/iam/oauth2scope"
"go.probo.inc/probo/pkg/probo"
"go.probo.inc/probo/pkg/uri"
)
@@ -29,7 +30,11 @@ import (
func TestNewMetadata(t *testing.T) {
t.Parallel()
apiScopes := []coredata.OAuth2Scope{probo.ScopeV1DocumentRead}
reg := oauth2scope.NewRegistry().Register(
map[coredata.OAuth2Scope][]string{
probo.ScopeV1DocumentRead: {"core:document:get"},
},
)
issuer := uri.URI("https://auth.example.com")
endpoints := oauth2.Endpoints{
@@ -43,7 +48,7 @@ func TestNewMetadata(t *testing.T) {
DeviceAuthorization: "https://auth.example.com/device",
}
metadata := oauth2.NewMetadata(issuer, endpoints, apiScopes)
metadata := oauth2.NewMetadata(issuer, endpoints, reg.RegisteredScopes())
require.NotNil(t, metadata)
t.Run(
@@ -83,7 +88,7 @@ func TestNewMetadata(t *testing.T) {
oauth2.ScopeEmail,
oauth2.ScopeOfflineAccess,
},
apiScopes,
reg.RegisteredScopes(),
)
assert.Equal(t, expectedScopes, metadata.ScopesSupported)

9
pkg/iam/oauth2/protected_resource_metadata.go
View File

@@ -15,8 +15,6 @@
package oauth2
import (
"slices"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/uri"
)
@@ -33,7 +31,7 @@ type ProtectedResourceMetadata struct {
func NewProtectedResourceMetadata(
resource uri.URI,
authorizationServer uri.URI,
apiScopes []coredata.OAuth2Scope,
registeredScopes []coredata.OAuth2Scope,
) *ProtectedResourceMetadata {
return &ProtectedResourceMetadata{
Resource: resource,
@@ -41,9 +39,6 @@ func NewProtectedResourceMetadata(
BearerMethodsSupported: []string{
"header",
},
ScopesSupported: slices.Concat(
[]coredata.OAuth2Scope{ScopeOpenID},
apiScopes,
),
ScopesSupported: protectedResourceScopes(registeredScopes),
}
}

9
pkg/iam/oauth2/protected_resource_metadata_test.go
View File

@@ -21,6 +21,7 @@ import (
"github.com/stretchr/testify/require"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/iam/oauth2"
"go.probo.inc/probo/pkg/iam/oauth2scope"
"go.probo.inc/probo/pkg/probo"
"go.probo.inc/probo/pkg/uri"
)
@@ -28,12 +29,16 @@ import (
func TestNewProtectedResourceMetadata(t *testing.T) {
t.Parallel()
apiScopes := []coredata.OAuth2Scope{probo.ScopeV1DocumentRead}
reg := oauth2scope.NewRegistry().Register(
map[coredata.OAuth2Scope][]string{
probo.ScopeV1DocumentRead: {"core:document:get"},
},
)
resource := uri.URI("https://app.example.com")
authorizationServer := uri.URI("https://app.example.com")
metadata := oauth2.NewProtectedResourceMetadata(resource, authorizationServer, apiScopes)
metadata := oauth2.NewProtectedResourceMetadata(resource, authorizationServer, reg.RegisteredScopes())
require.NotNil(t, metadata)
assert.Equal(t, resource, metadata.Resource)

40
pkg/iam/oauth2/scopes.go Normal file
View File

@@ -0,0 +1,40 @@
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package oauth2
import (
"slices"
"go.probo.inc/probo/pkg/coredata"
)
func authorizationServerScopes(registeredScopes []coredata.OAuth2Scope) []coredata.OAuth2Scope {
return slices.Concat(
[]coredata.OAuth2Scope{
ScopeOpenID,
ScopeProfile,
ScopeEmail,
ScopeOfflineAccess,
},
registeredScopes,
)
}
func protectedResourceScopes(registeredScopes []coredata.OAuth2Scope) []coredata.OAuth2Scope {
return slices.Concat(
[]coredata.OAuth2Scope{ScopeOpenID},
registeredScopes,
)
}

36
pkg/iam/oauth2/service.go
View File

@@ -31,7 +31,7 @@ import (
"go.probo.inc/probo/pkg/crypto/jose"
"go.probo.inc/probo/pkg/crypto/rand"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam/scopeset"
"go.probo.inc/probo/pkg/iam/oauth2scope"
"go.probo.inc/probo/pkg/net"
"go.probo.inc/probo/pkg/page"
"go.probo.inc/probo/pkg/uri"
@@ -63,7 +63,7 @@ type (
gc *GarbageCollector
cimd *cimdFetcher
cimdAllowedClientIDs []string
scopeSet *scopeset.ScopeSet
registry *oauth2scope.Registry
accessTokenDuration time.Duration
refreshTokenDuration time.Duration
authorizationCodeDuration time.Duration
@@ -128,11 +128,10 @@ type (
}
CreateManualAccessTokenRequest struct {
IdentityID gid.GID
Name string
ExpiresAt time.Time
Scopes coredata.OAuth2Scopes
AllowedAPIScopes []coredata.OAuth2Scope
IdentityID gid.GID
Name string
ExpiresAt time.Time
Scopes coredata.OAuth2Scopes
}
)
@@ -160,9 +159,9 @@ func WithDeviceCodeDuration(d time.Duration) Option {
}
}
func WithScopeSet(scopeSet *scopeset.ScopeSet) Option {
func WithRegistry(registry *oauth2scope.Registry) Option {
return func(s *Service) {
s.scopeSet = scopeSet
s.registry = registry
}
}
@@ -1918,8 +1917,8 @@ func (s *Service) CreateManualAccessToken(
return "", nil, NewError(ErrInvalidRequest, WithDescription("scopes are required"))
}
if err := validateManualAccessTokenScopes(req.Scopes, req.AllowedAPIScopes); err != nil {
return "", nil, err
if err := s.registry.ValidateScopes(req.Scopes); err != nil {
return "", nil, NewError(ErrInvalidScope, WithDescription(err.Error()))
}
tokenValue := rand.MustHexString(tokenByteLength)
@@ -1951,18 +1950,3 @@ func (s *Service) CreateManualAccessToken(
return tokenValue, accessToken, nil
}
func validateManualAccessTokenScopes(scopes, allowedAPIScopes coredata.OAuth2Scopes) error {
allowed := make(map[coredata.OAuth2Scope]struct{}, len(allowedAPIScopes))
for _, scope := range allowedAPIScopes {
allowed[scope] = struct{}{}
}
for _, scope := range scopes {
if _, ok := allowed[scope]; !ok {
return NewError(ErrInvalidScope, WithDescription("invalid scope: "+string(scope)))
}
}
return nil
}