data-deletion: send OAuth bearer token, document scope requirement | DAL-547 - #693
Conversation
Flip from make_api_no_auth! to make_api! so the OAuth bearer is actually sent, and document in the command help text that all operations require logs_delete_data and/or rum_delete_data, neither of which is requested by default.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 18e47f721b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| fn make_api(cfg: &Config) -> DataDeletionAPI { | ||
| crate::make_api_no_auth!(DataDeletionAPI, cfg) | ||
| crate::make_api!(DataDeletionAPI, cfg) |
There was a problem hiding this comment.
The existing data-deletion tests build their configuration with access_token: None, so this macro change is exercised only with API keys and never verifies the behavior it is intended to fix. If bearer middleware stops being installed—or the token header is malformed—the original OAuth-only failure will return while these tests remain green; add a bearer-only test that matches Authorization: Bearer <token> and corresponding failure-path coverage.
AGENTS.md reference: AGENTS.md:L22-L22
Useful? React with 👍 / 👎.
3 participants
Summary
pup data-deletion requests {list,create,cancel}frommake_api_no_auth!tomake_api!so the OAuth bearer is actually sent.logs_delete_dataand/orrum_delete_data, which are not requested by default.Scope check
Neither
logs_delete_datanorrum_delete_datais indefault_scopes()orread_only_scopes()today. All 3 routes require one of these permissions (OR), including the list/GET route, so there's no scope-free read path. Users must opt in withpup auth login --extra-scopes logs_delete_data,rum_delete_data.Test plan
cargo test data_deletionpassespup data-deletion requests listworks afterpup auth login --extra-scopes logs_delete_data,rum_delete_dataJira: DAL-547