fix: request the current scope vocabulary at login - #145
Merged
Conversation
`rb login` asked for `openid media:full offline_access`. media:full was retired with the scope vocabulary and now expands to nothing, so the flow still completed and handed back a token carrying zero scopes: login reported success and every call after it answered 403. A silent total failure rather than a refused login. The set here is what the CLI actually calls (jobs, assets, webhooks, billing, orgs, account) and nothing more. It never touches /api-keys, so it does not ask for keys:write, which matters because the rendobar-cli client is registered with skip_consent: whatever it asks for is granted with no screen for anyone to review. Must stay in step with packages/db/seeds/cli-oauth-client.sql in the api repo, since authorize validates the request against the scopes that client is registered with.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
rb loginasked foropenid media:full offline_access.media:fullwas retired with the scope vocabulary and now expands to no scopes at all, so the flow still completed and handed back a token carrying nothing: login reported success and every call after it answered 403.A silent total failure rather than a refused login, which is the worse of the two.
Nobody is affected today: the grants that held the alias were revoked when it was retired, and there are zero live CLI consents. The next
rb loginwould have hit it.The set
What the CLI actually calls, and nothing more:
jobs:write,assets:write,webhooks:write,billing:read,orgs:read, plusopenidandoffline_access.It never touches
/api-keys, so it does not ask forkeys:write. That matters more here than elsewhere because therendobar-cliclient is registered withskip_consent, meaning whatever it asks for is granted with no screen for anyone to review.Coordination
The matching server change shipped to production in rendobar/rendobar#630, which updates the seeded client's registered scopes.
authorizevalidates the request against those, so the two have to agree. The server side is already live, so this is safe to merge and release whenever.