rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Introduce oauth2scope registry with freeze lifecycle

Browse Source 
Replace pkg/iam/scopeset with pkg/iam/oauth2scope.Registry, a shared
OAuth2 scope→action registry used by the authorizer, OAuth2 service,
and Connect API. Registration stays open until probod calls Freeze();
read paths (RegisteredScopes, Allows, ValidateScopes) panic before
that.

Drop the leaky APIScopes surface and AllowedAPIScopes on manual
access-token creation in favor of registry.ValidateScopes. Metadata,
protected-resource metadata, and CIMD scope lists are built from
RegisteredScopes() via helpers in pkg/iam/oauth2/scopes.go. Expose
oauth2ScopesSupported as an OAuth2Scope GraphQL scalar.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-06-20 18:17:40 +02:00
parent 0d33750735
commit c93932f026
27 changed files with 310 additions and 235 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
pkg/iam/oauth2_scope_registrations_test.go
View File

@@ -22,37 +22,37 @@ import (
"go.probo.inc/probo/pkg/agentrun"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/iam/scopeset"
"go.probo.inc/probo/pkg/iam/oauth2scope"
"go.probo.inc/probo/pkg/probo"
)
func allRegisteredOAuth2ScopeSets() *scopeset.ScopeSet {
return scopeset.New().
func allRegisteredOAuth2ScopeRegistries() *oauth2scope.Registry {
return oauth2scope.NewRegistry().
Register(iam.IAMOAuth2ScopeMappings).
Register(probo.OAuth2ScopeMappings).
Register(accessreview.OAuth2ScopeMappings).
Register(agentrun.OAuth2ScopeMappings)
}
func TestRegisteredOAuth2ScopeSets_OrganizationRead(t *testing.T) {
func TestRegisteredOAuth2ScopeRegistries_OrganizationRead(t *testing.T) {
t.Parallel()
scopeSet := allRegisteredOAuth2ScopeSets()
reg := allRegisteredOAuth2ScopeRegistries()
tokenScopes := coredata.OAuth2Scopes{probo.ScopeV1OrgRead}
assert.True(t, scopeSet.Allows(tokenScopes, probo.ActionOrganizationGet))
assert.False(t, scopeSet.Allows(tokenScopes, probo.ActionOrganizationUpdate))
assert.False(t, scopeSet.Allows(tokenScopes, probo.ActionThirdPartyList))
assert.True(t, reg.Allows(tokenScopes, probo.ActionOrganizationGet))
assert.False(t, reg.Allows(tokenScopes, probo.ActionOrganizationUpdate))
assert.False(t, reg.Allows(tokenScopes, probo.ActionThirdPartyList))
}
func TestRegisteredOAuth2ScopeSets_UnmappedActionDenies(t *testing.T) {
func TestRegisteredOAuth2ScopeRegistries_UnmappedActionDenies(t *testing.T) {
t.Parallel()
scopeSet := allRegisteredOAuth2ScopeSets()
reg := allRegisteredOAuth2ScopeRegistries()
tokenScopes := coredata.OAuth2Scopes{
probo.ScopeV1OrgRead,
probo.ScopeV1ThirdPartyRead,
}
assert.False(t, scopeSet.Allows(tokenScopes, "core:unmapped:action"))
assert.False(t, reg.Allows(tokenScopes, "core:unmapped:action"))
}