cloudzilla Pull requests #341

Add OAuth scopes to access tokens #341

Open Draft Merged

@daisy wants to merge 3 commits into main from daisy/oauth-scopes

@malith merged 3 commits into main from daisy/oauth-scopes

This pull request is still a work in progress. Merge is blocked until it is marked ready for review.

D @daisy opened this pull request Author

Adds OAuth scope support to access tokens (PATs). Closes #298.

What changed:

  • New access_token_scopes table with FK to access_tokens
  • UI checkboxes for scope selection on token creation page
  • Middleware enforces scope on every API request
  • Token list shows scope badges

How to test:

make migrate
make dev
# Create a token at /settings/tokens with scope=repo:read only
curl -H "Authorization: Bearer $TOKEN" /api/repos
# Should 200. Then try POST — should 403.

Reviewers: this is the first time we're enforcing scopes, so the middleware change is the riskiest part.

  1. malith added the label feature

  2. malith assigned daisy

  3. M malith commented

    Nice work. One question on the middleware — if a token has no scopes assigned (legacy tokens), do we treat that as "all scopes" or "no scopes"? Right now internal/middleware/auth.go:88 reads like "all scopes" but I want to be sure.

  4. yumi Changes requested

    Legacy tokens should explicitly migrate to scopes=* before this ships — silent implicit all-scopes is a future foot-gun. Can you add the migration and update CLAUDE.md?
  5. D daisy commented

    Good catch. Pushed 9c8e2a4 (backfills legacy tokens with scopes=*) and 3b1f7da (documents it in the token section).

  6. yumi Approved

  7. malith merged this pull request (3 commits)

Reviewed the changes? Approve, request changes or leave a summary.

You can reply to review comments, but not approve your own pull request.

Ready to merge

This branch has no conflicts with the base and can be merged.

  • 3 commits ahead, 0 behind the base branch
  • All 6 required checks passed
  • All 1 required review approved
  • This branch has no conflicts with main

Only collaborators with write access can merge or close this pull request.

Review required

1 of 2 required reviews approved.

  • 3 commits ahead, 0 behind the base branch
  • All 6 required checks passed
  • 1 of 2 required reviews approved
  • This branch has no conflicts with main

Only collaborators with write access can merge or close this pull request.

Waiting on checks

4 of 6 required checks passed.

  • 3 commits ahead, 0 behind the base branch
  • 4 of 6 required checks passed
  • All 1 required review approved
  • This branch has no conflicts with main

Only collaborators with write access can merge or close this pull request.

Checks failing

2 required checks failed. Fix them and push before this can merge.

  • 3 commits ahead, 0 behind the base branch
  • 4 of 6 required checks passed
  • All 1 required review approved
  • This branch has no conflicts with main

Only collaborators with write access can merge or close this pull request.

Changes requested

A reviewer asked for changes. Merging is blocked until they approve or the review is dismissed.

  • 3 commits ahead, 0 behind the base branch
  • All 6 required checks passed
  • 0 of 1 required review approved
  • This branch has no conflicts with main

Only collaborators with write access can merge or close this pull request.

Merge conflicts

Resolve the conflicts on the head branch before this can merge.

  • 3 commits ahead, 0 behind the base branch
  • All 6 required checks passed
  • All 1 required review approved
  • This branch has conflicts with main

Only collaborators with write access can merge or close this pull request.

Review required

1 of 2 required reviews approved.

  • 3 commits ahead, 0 behind the base branch
  • All 6 required checks passed
  • 1 of 2 required reviews approved
  • This branch has no conflicts with main

Auto-merge is on (squash and merge), armed by @malith. It merges once the requirements are met.

Only collaborators with write access can merge or close this pull request.

Draft

Mark this ready for review to notify reviewers and allow merging.

  • 3 commits ahead, 0 behind the base branch
  • All 6 required checks passed
  • All 1 required review approved
  • This branch has no conflicts with main

Only collaborators with write access can merge or close this pull request.

M Add a comment

Markdown supported · drop files to attach

Close this pull request?

Close pull request #341 — Add OAuth scopes to access tokens. You can reopen it later if needed.

Review changes

Line comments you add on the Files tab are posted as you write them. This adds your summary and verdict to #341.

You opened this pull request, so you can only comment on it.

Confirm merge

Squash and merge into main.