rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Register API scopes on prb CLI OAuth client

Browse Source 
Device logins only requested OIDC scopes while the authorizer now
gates API calls on v1:* scopes. Register the full scope set on the
well-known prb client, request it at login via CLIClientScopes, and
cover the device flow in e2e.

Collapse API scopes under an accordion on the consent screen and
document scope sync for future namespace additions.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-06-18 14:25:06 +02:00
parent 26c5002932
commit fd2e0903ee
7 changed files with 259 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
contrib/claude/authorization.md
View File

@@ -320,6 +320,16 @@ Manual bearer tokens created from the console are stored in `iam_oauth2_access_t
| `AUDITOR` | Read-only, excludes internal/employee content |
| `EMPLOYEE` | Can sign documents and view internal content |
## Built-in role policies
| Role | Access level |
|------|-------------|
| `OWNER` | Full access to all features including org management |
| `ADMIN` | Full access to core features, restricted org management |
| `VIEWER` | Read-only access to most entities |
| `AUDITOR` | Read-only, excludes internal/employee content |
| `EMPLOYEE` | Can sign documents and view internal content |
## New entity IAM wiring
When adding a new entity that needs authorization: