rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Register API scopes on prb CLI OAuth client

Browse Source 
Device logins only requested OIDC scopes while the authorizer now
gates API calls on v1:* scopes. Register the full scope set on the
well-known prb client, request it at login via CLIClientScopes, and
cover the device flow in e2e.

Collapse API scopes under an accordion on the consent screen and
document scope sync for future namespace additions.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-06-18 14:25:06 +02:00
parent 26c5002932
commit fd2e0903ee
7 changed files with 259 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
pkg/cli/config/config.go
View File

@@ -33,6 +33,28 @@ const (
// CLIClientID is the well-known OAuth2 client ID for the Probo CLI,
// pre-provisioned in every Probo database via migration.
CLIClientID = "AAAAAAAAAAAASwAAAAAAAAAAcHJiY2xp"
// CLIClientScopes is the space-separated scope string requested at prb login.
// Keep in sync with iam_oauth2_clients.scopes for CLIClientID (see migrations).
CLIClientScopes = "openid profile email offline_access " +
"v1:access-review v1:access-review:read " +
"v1:agent v1:agent:read " +
"v1:asset v1:asset:read " +
"v1:audit v1:audit:read " +
"v1:common-third-party v1:common-third-party:read " +
"v1:compliance-page v1:compliance-page:read " +
"v1:connector v1:connector:read " +
"v1:control v1:control:read " +
"v1:datum v1:datum:read " +
"v1:document v1:document:read " +
"v1:iam v1:iam:read " +
"v1:org v1:org:read " +
"v1:privacy v1:privacy:read " +
"v1:risk v1:risk:read " +
"v1:slack-connection v1:slack-connection:read " +
"v1:task v1:task:read " +
"v1:third-party v1:third-party:read " +
"v1:webhook v1:webhook:read"
)
type (