feature-flags: request required scopes by default | DAL-929 - #695
Conversation
pup feature-flags flags list (and all other feature-flags operations) was failing OAuth permission checks with 403 Forbidden because none of the feature_flag_* scopes were requested at login. Adds all 5 permissions used across the public API (config/environment read+write, approvals_override) to default_scopes(), and the two read scopes to read_only_scopes(). Documents the requirement in the command help text.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7aa242ba18
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…dd tests - Removed feature_flag_approvals_override from default_scopes(): no pup command exposes require-approval, so this granted an unnecessary approval-bypass permission for no reason. - Rewrote the AUTHENTICATION help text to describe per-operation scope requirements accurately instead of implying every operation needs a config+environment scope pair (environments list/get/create/update/delete only need the environment scope alone). - Added test_default_scopes_feature_flags and test_read_only_scopes_feature_flags asserting the exact scope sets, since the existing generic scope tests didn't reference any feature_flag_* name and would still pass if they were wrong.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3034927f6a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
2 participants
Fixes #679, together with a server-side update
Summary
pup feature-flags flags list(and all other feature-flags operations) fails with403 Forbidden/ "Failed permission authorization checks" after the server-side OAuth fix for this command group deployed. Root cause: pup was never requesting anyfeature_flag_*scope at login, so the OAuth token it has simply doesn't carry the required permissions -- a scope-request gap, not a route-auth gap.Scope check
Five distinct permissions are used across this command group, all already public/grantable OAuth scopes:
feature_flag_config_readfeature_flag_config_writefeature_flag_environment_config_readfeature_flag_environment_config_writefeature_flag_approvals_overrideNone of these were in
default_scopes()orread_only_scopes()before this PR. Adds all 5 todefault_scopes()(consistent with other write-capable-but-not-especially-sensitive scopes already there, e.g.org_management,teams_manage), and the two read scopes toread_only_scopes().Test plan
cargo test default_scopespassespup feature-flags flags listsucceeds afterpup auth login(fresh login required to pick up newly-requested scopes)Jira: DAL-929