Skip to content

feat: add env:sandbox and env:live OAuth scopes #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jjmaxwell4 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: add env:sandbox and env:live OAuth scopes #3

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 17 additions & 7 deletions shared/utils/scopeDefinitions.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,11 @@ export const OPENID_SCOPES = [
"offline_access",
] as const;

/**
* Environment scopes — appended by OAuth clients to select sandbox or live
*/
export const ENV_SCOPES = ["env:sandbox", "env:live"] as const;

/**
* Legacy scopes (for backward compatibility with existing clients)
* @deprecated Use resource:action format instead (e.g., apiKeys:read)
Expand Down Expand Up @@ -79,6 +84,7 @@ export const RESOURCE_SCOPES: ScopeString[] = [
*/
export const ALL_SCOPES = [
...OPENID_SCOPES,
...ENV_SCOPES,
...LEGACY_SCOPES,
...RESOURCE_SCOPES,
];
Expand Down Expand Up @@ -194,11 +200,12 @@ export function groupScopesByResource(
const grouped = new Map<ResourceType, ScopeActionType[]>();

for (const scope of scopes) {
// Skip OpenID scopes - they're not resource-based
if (isOpenIdScope(scope)) continue;
if ((ENV_SCOPES as readonly string[]).includes(scope)) continue;

const { resource, action } = parseScope(scope);
if (!resource || !action) continue;
if (!(resource in RESOURCE_METADATA)) continue;

const existingActions = grouped.get(resource) || [];
if (!existingActions.includes(action)) {
Expand Down Expand Up @@ -278,18 +285,18 @@ export function getResourceDescription(resource: ResourceType): string {
/**
* Check if a scope is valid
*/
export function isValidScope(scope: string): scope is ScopeString {
return ALL_SCOPES.includes(scope as ScopeString);
export function isValidScope(scope: string): boolean {
return (ALL_SCOPES as readonly string[]).includes(scope);
}

/**
* Validate an array of scopes
*/
export function validateScopes(scopes: string[]): {
valid: ScopeString[];
valid: string[];
invalid: string[];
} {
const valid: ScopeString[] = [];
const valid: string[] = [];
const invalid: string[] = [];

for (const scope of scopes) {
Expand Down Expand Up @@ -320,12 +327,15 @@ export function groupAndFormatScopes(scopes: string[]): GroupedPermission[] {
const result: GroupedPermission[] = [];

for (const [resource, actions] of grouped.entries()) {
const meta = RESOURCE_METADATA[resource];
if (!meta) continue;

result.push({
resource,
resourceName: RESOURCE_METADATA[resource].namePlural,
resourceName: meta.namePlural,
actions,
formattedPermission: formatResourcePermission(resource, actions),
description: RESOURCE_METADATA[resource].description,
description: meta.description,
});
}

Expand Down
Loading