rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Register API scopes on prb CLI OAuth client

Browse Source 
Device logins only requested OIDC scopes while the authorizer now
gates API calls on v1:* scopes. Register the full scope set on the
well-known prb client, request it at login via CLIClientScopes, and
cover the device flow in e2e.

Collapse API scopes under an accordion on the consent screen and
document scope sync for future namespace additions.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-06-18 14:25:06 +02:00
parent 26c5002932
commit fd2e0903ee
7 changed files with 259 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
contrib/claude/authorization.md
View File

@@ -320,6 +320,16 @@ Manual bearer tokens created from the console are stored in `iam_oauth2_access_t
| `AUDITOR` | Read-only, excludes internal/employee content |
| `EMPLOYEE` | Can sign documents and view internal content |
## Built-in role policies
| Role | Access level |
|------|-------------|
| `OWNER` | Full access to all features including org management |
| `ADMIN` | Full access to core features, restricted org management |
| `VIEWER` | Read-only access to most entities |
| `AUDITOR` | Read-only, excludes internal/employee content |
| `EMPLOYEE` | Can sign documents and view internal content |
## New entity IAM wiring
When adding a new entity that needs authorization:

30
contrib/claude/cli.md
View File

@@ -225,6 +225,36 @@ f.IOStreams.IsInteractive() // true if TTY and not forced non-interactive
Environment variables: `PROBO_NO_INTERACTIVE=1`, `CI=true`, `TERM=dumb` (non-interactive), `NO_COLOR` (disable color).
## OAuth device login (`prb auth login`)
The well-known CLI OAuth client (`config.CLIClientID`) requests `config.CLIClientScopes` at device authorization. Keep three places in sync when adding `v1:*` scopes:
1. Scope constants and `OAuth2ScopeSet()` registration in the owning package
2. `iam_oauth2_clients.scopes` for `CLIClientID` (SQL migration)
3. `CLIClientScopes` in `pkg/cli/config/config.go`
After scope changes ship, users must re-authenticate so new tokens carry the updated scopes:
```sh
prb auth logout --hostname <host>
prb auth login --hostname <host>
```
Existing tokens may be backfilled by migration; fresh logins need the client row and `CLIClientScopes` updated.
### Local development against probod
```sh
make stack-up
make build
make dev-config
bin/probod -cfg-file cfg/dev.yaml # API + OAuth at http://localhost:8080
bin/prb auth login --hostname http://localhost:8080
```
Use `http://` explicitly — hosts without a scheme default to HTTPS. Config is stored under the OS user config dir (`prb/config.yaml`). Override with `PROBO_HOST` and `PROBO_TOKEN` for scripting; see `contrib/seed.sh` for a personal API key bootstrap.
## New resource command checklist
1. **Group command** — `pkg/cmd/<resource>/<resource>.go` with `NewCmd<Resource>(f)`, wiring all verb subcommands