c93932f026
Replace pkg/iam/scopeset with pkg/iam/oauth2scope.Registry, a shared OAuth2 scope→action registry used by the authorizer, OAuth2 service, and Connect API. Registration stays open until probod calls Freeze(); read paths (RegisteredScopes, Allows, ValidateScopes) panic before that. Drop the leaky APIScopes surface and AllowedAPIScopes on manual access-token creation in favor of registry.ValidateScopes. Metadata, protected-resource metadata, and CIMD scope lists are built from RegisteredScopes() via helpers in pkg/iam/oauth2/scopes.go. Expose oauth2ScopesSupported as an OAuth2Scope GraphQL scalar. Signed-off-by: Ludovic Vielle <ludovic@probo.com>
49 lines
1.1 KiB
YAML
49 lines
1.1 KiB
YAML
schema:
|
|
- "graphql/*.graphql"
|
|
- "../../../gqlutils/directives/authentication/schema.graphql"
|
|
- "../../../gqlutils/directives/session/schema.graphql"
|
|
|
|
exec:
|
|
filename: "schema/schema.go"
|
|
package: "schema"
|
|
|
|
model:
|
|
filename: "types/types.go"
|
|
package: "types"
|
|
|
|
resolver:
|
|
layout: "follow-schema"
|
|
dir: "."
|
|
package: "connect_v1"
|
|
filename_template: "{name}_resolvers.go"
|
|
|
|
autobind: []
|
|
call_argument_directives_with_null: true
|
|
|
|
directives:
|
|
mustBeAuthorized:
|
|
skip_runtime: false
|
|
authentication:
|
|
skip_runtime: false
|
|
sessionOnly:
|
|
skip_runtime: false
|
|
|
|
models:
|
|
ID:
|
|
model:
|
|
- "go.probo.inc/probo/pkg/server/gqlutils/types/gid.GIDScalar"
|
|
Datetime:
|
|
model:
|
|
- "github.com/99designs/gqlgen/graphql.Time"
|
|
CursorKey:
|
|
model:
|
|
- "go.probo.inc/probo/pkg/server/gqlutils/types/cursor.CursorKeyScalar"
|
|
BigInt:
|
|
model:
|
|
- "go.probo.inc/probo/pkg/server/gqlutils/types/bigint.BigIntScalar"
|
|
EmailAddr:
|
|
model:
|
|
- "go.probo.inc/probo/pkg/server/gqlutils/types/mail.AddrScalar"
|
|
OAuth2Scope:
|
|
model:
|
|
- go.probo.inc/probo/pkg/server/gqlutils/types/oauth2scope.OAuth2ScopeScalar |