c93932f026
Replace pkg/iam/scopeset with pkg/iam/oauth2scope.Registry, a shared OAuth2 scope→action registry used by the authorizer, OAuth2 service, and Connect API. Registration stays open until probod calls Freeze(); read paths (RegisteredScopes, Allows, ValidateScopes) panic before that. Drop the leaky APIScopes surface and AllowedAPIScopes on manual access-token creation in favor of registry.ValidateScopes. Metadata, protected-resource metadata, and CIMD scope lists are built from RegisteredScopes() via helpers in pkg/iam/oauth2/scopes.go. Expose oauth2ScopesSupported as an OAuth2Scope GraphQL scalar. Signed-off-by: Ludovic Vielle <ludovic@probo.com>
48 lines
1.0 KiB
GraphQL
48 lines
1.0 KiB
GraphQL
directive @goField(
|
|
forceResolver: Boolean
|
|
name: String
|
|
omittable: Boolean
|
|
) on INPUT_FIELD_DEFINITION | FIELD_DEFINITION
|
|
|
|
directive @goModel(
|
|
model: String
|
|
models: [String!]
|
|
) on OBJECT | INPUT_OBJECT | SCALAR | ENUM | INTERFACE | UNION
|
|
|
|
directive @goEnum(value: String) on ENUM_VALUE
|
|
|
|
scalar BigInt
|
|
scalar CursorKey
|
|
scalar Datetime
|
|
scalar Upload
|
|
scalar EmailAddr
|
|
scalar OAuth2Scope
|
|
|
|
interface Node {
|
|
id: ID!
|
|
}
|
|
|
|
type Query {
|
|
node(id: ID!): Node @authentication(required: PRESENT)
|
|
viewer: Identity @authentication(required: PRESENT)
|
|
ssoLoginURL(email: EmailAddr!): String
|
|
@goField(forceResolver: true)
|
|
@authentication(required: OPTIONAL)
|
|
oidcProviders: [OIDCProviderInfo!]!
|
|
@goField(forceResolver: true)
|
|
@authentication(required: OPTIONAL)
|
|
signUpEnabled: Boolean!
|
|
@goField(forceResolver: true)
|
|
@authentication(required: OPTIONAL)
|
|
oauth2ScopesSupported: [OAuth2Scope!]!
|
|
@goField(forceResolver: true)
|
|
@authentication(required: OPTIONAL)
|
|
}
|
|
|
|
type OIDCProviderInfo {
|
|
name: String!
|
|
loginURL: String!
|
|
}
|
|
|
|
type Mutation
|