feature-flags: request required scopes by default | DAL-929

src/auth/types.rs

@@ -64,6 +64,8 @@ pub fn read_only_scopes() -> Vec<&'static str> {
         "dbm_read",
         "error_tracking_read",
         "events_read",
+        "feature_flag_config_read",
+        "feature_flag_environment_config_read",
         "gcp_configuration_read",
         "disaster_recovery_status_read",
         "hosts_read",
@@ -161,6 +163,11 @@ pub fn default_scopes() -> Vec<&'static str> {
         "error_tracking_read",
         // Events
         "events_read",
+        // Feature Flags
+        "feature_flag_config_read",
+        "feature_flag_config_write",
+        "feature_flag_environment_config_read",
+        "feature_flag_environment_config_write",
         // GCP
         "gcp_configuration_read",
         // HAMR (disaster recovery)
@@ -338,6 +345,28 @@ mod tests {
         assert!(scopes.contains(&"logs_write_pipelines"));
     }
 
+    #[test]
+    fn test_default_scopes_feature_flags() {
+        let scopes = default_scopes();
+        assert!(scopes.contains(&"feature_flag_config_read"));
+        assert!(scopes.contains(&"feature_flag_config_write"));
+        assert!(scopes.contains(&"feature_flag_environment_config_read"));
+        assert!(scopes.contains(&"feature_flag_environment_config_write"));
+        // No pup command exposes require-approval, so this scope shouldn't
+        // be requested by default.
+        assert!(!scopes.contains(&"feature_flag_approvals_override"));
+    }
+
+    #[test]
+    fn test_read_only_scopes_feature_flags() {
+        let ro = read_only_scopes();
+        assert!(ro.contains(&"feature_flag_config_read"));
+        assert!(ro.contains(&"feature_flag_environment_config_read"));
+        assert!(!ro.contains(&"feature_flag_config_write"));
+        assert!(!ro.contains(&"feature_flag_environment_config_write"));
+        assert!(!ro.contains(&"feature_flag_approvals_override"));
+    }
+
     #[test]
     fn test_read_only_scopes_no_write_or_manage() {
         let ro = read_only_scopes();

src/main.rs

@@ -1370,7 +1370,16 @@ enum Commands {
     ///
     /// AUTHENTICATION:
     ///   Requires either OAuth2 authentication (pup auth login) or API keys
-    ///   (DD_API_KEY and DD_APP_KEY environment variables).
+    ///   (DD_API_KEY and DD_APP_KEY environment variables). All 4 scopes
+    ///   below are requested by default.
+    ///     flags list/get, allocations list  -- feature_flag_config_read +
+    ///                                          feature_flag_environment_config_read
+    ///     flags create/update/archive/unarchive/delete, enable/disable,
+    ///     allocations create/update, exposure schedule actions --
+    ///                                          feature_flag_config_write +
+    ///                                          feature_flag_environment_config_read
+    ///     environments list/get             -- feature_flag_environment_config_read
+    ///     environments create/update/delete -- feature_flag_environment_config_write
     #[command(name = "feature-flags", verbatim_doc_comment)]
     FeatureFlags {
         #[command(subcommand)]