[TB] add OAuth entry #20049
[TB] add OAuth entry #20049
Conversation
| // We scope all so that it can work in papi like a PAT | ||
| { name: "function:*" }, |
There was a problem hiding this comment.
💭 Is it necessary to whitelist all scopes or can we limit it to some extent of internal functions, like we did for the other clients?
There was a problem hiding this comment.
Yes we do, because we need to use papi v1 entry. #19597 (comment)
We can update it anyway in the future
There was a problem hiding this comment.
For more context, the limitation is here
gitpod/components/server/src/auth/bearer-authenticator.ts
Lines 115 to 119 in 8df5d2f
There was a problem hiding this comment.
But I have no idea when we can do it
| allowedGrants: ["authorization_code"], | ||
| scopes: [ | ||
| // We scope all so that it can work in papi like a PAT | ||
| { name: "function:*" }, |
There was a problem hiding this comment.
Maybe still makes sense revisiting after we decide what methods are important to scope this down? Or is that not possible with p-api?
There was a problem hiding this comment.
Thank you, we have reason to set it to all scopes #20049 (comment) for now
Description
Related Issue(s)
Fixes #
How to test
Once build is passed
Documentation
Preview status
gitpod:summary
Build Options
Build
Run the build with werft instead of GHA
Run Leeway with
--dont-testPublish
Installer
Add desired feature flags to the end of the line above, space separated
Preview Environment / Integration Tests
If enabled this will build
install/previewIf enabled this will create the environment on GCE infra
Saves cost. Untick this only if you're really sure you need a non-preemtible machine.
Valid options are
all,workspace,webapp,ide,jetbrains,vscode,ssh. If enabled,with-previewandwith-large-vmwill be enabled./hold