datasets: send OAuth bearer token, document user_access_manage scope requirement | DAL-548 - #691
Conversation
…requirement All 5 dataset operations require the user_access_manage scope server-side, which is not requested by default. Flip from make_api_no_auth! to make_api! so the OAuth bearer is actually sent, and document the --extra-scopes opt-in in the command help text, mirroring the existing logs-restriction pattern.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 93dd0847f0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 93dd0847f0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Existing tests used an all-defaults test_config with no access_token, so the make_api_no_auth! -> make_api! change wasn't exercised by any test.
2 participants
Summary
pup datasets {list,get,create,update,delete}frommake_api_no_auth!tomake_api!so the OAuth bearer is actually sent.user_access_manage, which is not requested by default -- mirrors the existinglogs-restrictionprecedent (pup auth login --extra-scopes user_access_manage).Why not just add the scope to defaults?
user_access_manageis deliberately excluded from pup's default/read-only scope lists (same as for logs-restriction writes) since it's broad and sensitive. This PR sends the token when present and lets users opt in explicitly, rather than changing that policy.Test plan
cargo test datasetspassespup datasets listworks withpup auth login --extra-scopes user_access_manageJira: DAL-548