Scopes support in auth commands #4327
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tejaskochar-db
requested review from
andrewnester,
anton-107,
denik,
pietern and
shreyas-goenka
as code owners
tejaskochar-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
tejaskochar-db
changed the title
tejaskochar-db
changed the title
tejaskochar-db
requested review from
hectorcast-db
and removed request for
andrewnester,
anton-107,
denik,
pietern and
shreyas-goenka
Collaborator
|
Commit: d54ef9e
28 interesting tests: 8 flaky, 8 RECOVERED, 5 KNOWN, 5 SKIP, 2 FAIL
Top 50 slowest tests (at least 2 minutes):
|
tejaskochar-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
tejaskochar-db
changed the title
tejaskochar-db
commented
Jan 22, 2026
Comment on lines
+199
to
+201
| // wrapAuthErrorWithScopeContext adds context to an authentication error when the | ||
| // configuration does not include the 'all-apis' scope, which may cause validation | ||
| // API calls to fail even though the token itself is valid for its intended purpose. |
Contributor
Author
There was a problem hiding this comment.
In case of insufficient scopes, the server responds with a 403 and Provided OAuth token does not have required scopes: ... message. I could instead match on the error message and determine auth to be valid instead of adding a note saying the error may just be due to insufficient scopes.
This is, of course, brittle but allows for more accurate validation.
What is the reason for having this validation in the first place?
tejaskochar-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
tejaskochar-db
requested review from
andrewnester,
anton-107,
denik,
pietern and
shreyas-goenka
tejaskochar-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
tejaskochar-db
requested review from
renaudhartert-db
and removed request for
hectorcast-db
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
auth logincommand to take--scopesas an argumentauth describeandauth profilescommands to also display scopes. They give a warning that validation of authentication may not work correctly when using scopes. This is because we validate by making calls requiring specific scopes which the user may not have requested.Why
These changes come as part of an effort to support fine-grained, user-provided scopes in all our tools.
Tests
auth profilesoutput: