fix: exclude cloud-platform from the all scopes preset - #13
Open
Mr-Neutr0n wants to merge 1 commit into
Open
Conversation
Data-plane endpoints reject any token carrying cloud-platform, so auth login --scopes-preset all produced credentials that could not read any health data (403 disallowed OAuth scope). The preset now covers only health-data scopes; webhook admin keeps working through a separate --scopes cloud-platform login as the webhooks docs already describe. The auth login help text and flag description now say what 'all' actually covers and point at 'ghealth webhooks --help' for the webhook-credential pattern. Adds regression tests for the preset. Fixes Google-Health-API#3 Signed-off-by: Mr-Neutr0n <64578610+Mr-Neutr0n@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3
Problem
auth login --scopes-preset allreturned every scope inAllScopes, includingcloud-platform. The data-plane endpoints reject any token carrying it, so the resulting credentials could not run a single data command (403 "Request contains disallowed OAuth scope(s)"). The incompatibility was documented only inwebhooks --help, nothing near the preset itself.Change
ScopePreset("all")now skips thecloud-platformsuffix, so the preset covers health-data scopes only. Comment on the case explains why, so the next reader does not reintroduce it.auth loginhelp text and the--scopes-presetflag description state whatallcovers and point atghealth webhooks --helpfor the separate-login pattern.pkg/auth/auth_test.go: regression test thatallexcludescloud-platformbut still contains every other registered scope, plus coverage for readonly, category expansion, unknown presets, and a count guard against future scopes being silently dropped.Verification
This change was prepared with AI assistance under human direction and review.