feat: add multi-scope support to API keys#19917
Merged
ThomasK33 merged 1 commit intoSep 26, 2025
Merged
Conversation
This was referenced Sep 22, 2025
Member
Author
b25f825 to
ae9cd7c
Compare
3e06647 to
8f46553
Compare
ae9cd7c to
24afdea
Compare
b5a1899 to
df26fde
Compare
24afdea to
592b758
Compare
df26fde to
379833f
Compare
592b758 to
3223b46
Compare
dd9f91b to
29f787f
Compare
e3bf61c to
c29d8ce
Compare
29f787f to
7f43f71
Compare
c29d8ce to
5562ff4
Compare
3e3def7 to
9060574
Compare
57ec770 to
411151c
Compare
9060574 to
f5e0777
Compare
411151c to
73e3922
Compare
f5e0777 to
2bf3c3c
Compare
3f1594c to
dd9a21c
Compare
e5ef1f0 to
32b4c5d
Compare
0edbf0c to
bb211fa
Compare
32b4c5d to
6b3d164
Compare
bb211fa to
a4a9d57
Compare
6b3d164 to
5335d8b
Compare
a4a9d57 to
acadd79
Compare
6b9783a to
a3329a4
Compare
acadd79 to
b8267e1
Compare
a3329a4 to
45d6550
Compare
9e0bf76 to
1c54aa1
Compare
Emyrk
approved these changes
Sep 25, 2025
johnstcn
approved these changes
Sep 26, 2025
Member
Author
Merge activity
|
This change unifies scope handling by migrating special scopes to the coder:* namespace while maintaining backward compatibility: - Database: 'all' -> 'coder:all', 'application_connect' -> 'coder:application_connect' - API accepts both legacy and canonical forms in requests - Responses maintain legacy format for existing client compatibility - Scope catalog returns all public scopes including canonical specials - Validation enforces public scope requirements using unified logic The migration preserves existing API key functionality while establishing consistent scope naming conventions for future extensibility.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Canonicalize API Key Scopes
This PR introduces canonical API key scopes with a
coder:namespace prefix to avoid collisions with low-level resource:action names. It:Renames special API key scopes in the database:
all→coder:allapplication_connect→coder:application_connectAdds support for a new
scopesfield in the API key creation request, allowing multiple scopes to be specified while maintaining backward compatibility with the singularscopefield.Updates the API documentation to reflect these changes, including the new endpoint for listing public API key scopes.
Ensures backward compatibility by mapping between legacy and canonical scope names in relevant code paths.