Conversation
Contributor
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds optional Azure OAuth scopes across schema, UI, persistence, migration, and provider code; token requests now use a cleaned scopes list from Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant UI as "UI Form"
participant API as "Config API"
participant DB as "Database"
participant Provider as "Azure Provider"
participant Azure as "Azure Entra ID"
User->>UI: Enter/save key + custom scopes
UI->>API: Submit key config (includes scopes)
API->>DB: Persist key (azure_scopes column)
DB-->>API: OK
Provider->>DB: Load key config
DB-->>Provider: Key config (deserialized scopes)
Provider->>Azure: Request token with scopes (custom or default)
Azure-->>Provider: Access token
Provider-->>User: Return token
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
🧪 Test Suite AvailableThis PR can be tested by a repository admin. |
Collaborator
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
TejasGhatte
force-pushed
the
02-04-feat_add_scopes_field_in_azure_key_config_for_entra_id_auth
branch
from
86a7d30 to
1beefc8
Compare
akshaydeo
reviewed
Feb 5, 2026
akshaydeo
reviewed
Feb 5, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@core/providers/azure/azure.go`:
- Around line 86-93: The Azure token request must not include empty or
whitespace-only scopes: before calling cred.GetToken (and when building
policy.TokenRequestOptions), normalize key.AzureKeyConfig.Scopes by trimming
each entry and filtering out empty strings, then if the resulting slice is empty
set scopes = []string{DefaultAzureScope}; for client credentials ensure you pass
the single cleaned scope that ends with "/.default" (or fallback to
DefaultAzureScope) into TokenRequestOptions so cred.GetToken receives only
valid, trimmed scopes.
In `@framework/configstore/tables/key.go`:
- Around line 99-107: The code references AzureKeyConfig.Scopes (in key.go
around the AzureScopesJSON handling) but the build-time schema for
schemas.AzureKeyConfig does not define Scopes; update the schema used at build
time so schemas.AzureKeyConfig includes the Scopes field (with the correct type,
e.g., []string) or, if the schema intentionally uses a different field name,
change the code to read that existing field instead of Scopes; ensure all
duplicated/alternate schema definitions are synchronized so AzureKeyConfig and
the code paths setting AzureScopesJSON (and the similar block around lines
~232-245) compile against the same field name.
1beefc8 to
7b7aafa
Compare
16 tasks
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@core/providers/azure/azure.go`:
- Around line 86-89: The getAzureScopes helper currently appends the untrimmed
scope string causing potential Azure auth failures; update the function
(getAzureScopes in utils.go) to append the trimmed value (use
strings.TrimSpace(s)) instead of the original s so only whitespace-trimmed scope
entries are returned and passed to cred.GetToken.
🧹 Nitpick comments (2)
core/providers/azure/utils.go (1)
67-81: Consider trimming scope strings before adding them.The function checks if the trimmed value is non-empty (line 72) but appends the original untrimmed string (line 73). If a user accidentally provides a scope with leading/trailing whitespace, it would pass validation but could cause authentication issues.
♻️ Proposed fix to trim scopes
func getAzureScopes(configuredScopes []string) []string { scopes := []string{DefaultAzureScope} if len(configuredScopes) > 0 { cleaned := make([]string, 0, len(configuredScopes)) for _, s := range configuredScopes { - if strings.TrimSpace(s) != "" { - cleaned = append(cleaned, s) + trimmed := strings.TrimSpace(s) + if trimmed != "" { + cleaned = append(cleaned, trimmed) } } if len(cleaned) > 0 { scopes = cleaned } } return scopes }framework/configstore/clientconfig.go (1)
296-298: Consider defensive copy of the scopes slice.The current implementation assigns the slice reference directly, which means modifications to the redacted config's scopes would affect the original. While this follows the existing pattern for
Deploymentsand other fields in this function, a defensive copy would be safer.🛡️ Optional: Defensive copy
if len(key.AzureKeyConfig.Scopes) > 0 { - azureConfig.Scopes = key.AzureKeyConfig.Scopes + azureConfig.Scopes = make([]string, len(key.AzureKeyConfig.Scopes)) + copy(azureConfig.Scopes, key.AzureKeyConfig.Scopes) }
TejasGhatte
force-pushed
the
02-04-feat_add_scopes_field_in_azure_key_config_for_entra_id_auth
branch
from
7b7aafa to
d193b85
Compare
akshaydeo
approved these changes
Feb 5, 2026
Contributor
Merge activity
|
TejasGhatte
force-pushed
the
02-04-feat_add_scopes_field_in_azure_key_config_for_entra_id_auth
branch
from
d193b85 to
fbb5419
Compare
akshaydeo
deleted the
02-04-feat_add_scopes_field_in_azure_key_config_for_entra_id_auth
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add configurable OAuth scopes for Azure authentication
This PR adds support for custom OAuth scopes when authenticating with Azure Entra ID. Previously, the Azure provider used a hardcoded scope (
https://cognitiveservices.azure.com/.default), but some Azure environments may require different or additional scopes.Changes
scopesfield to theAzureKeyConfigstructure to allow specifying custom OAuth scopesType of change
Affected areas
How to test
{ "provider": "azure", "azure_key_config": { "endpoint": "https://your-endpoint.openai.azure.com/", "client_id": "your-client-id", "client_secret": "your-client-secret", "tenant_id": "your-tenant-id", "scopes": ["https://cognitiveservices.azure.com/.default", "custom-scope"] } }Breaking changes
Security considerations
This change enhances security by allowing more granular control over the OAuth scopes used for Azure authentication, which follows the principle of least privilege.
Checklist