Skip to content

fix(auth): correct OAuth scopes and add missing unstable op#1

Closed
srosenthal-dd wants to merge 1 commit intofix/add-missing-oauth-scopesfrom
fix/oauth-scope-corrections
Closed

fix(auth): correct OAuth scopes and add missing unstable op#1
srosenthal-dd wants to merge 1 commit intofix/add-missing-oauth-scopesfrom
fix/oauth-scope-corrections

Conversation

@srosenthal-dd
Copy link
Owner

Summary

Corrections on top of datadog-labs#144 — tested E2E with OAuth against datad0g.com.

Changes

Scopes (src/auth/types.rs):

  • Remove ci_visibility_pipelines_write (no pup commands use it)
  • Remove apm_service_catalog_write (no write commands for service catalog)
  • Add test_optimization_read (required for cicd tests list/search/aggregate)
  • Add test_optimization_write (required for cicd flaky-tests update)
  • Add dora_metrics_write (required for cicd dora patch-deployment)

Bugfix (src/client.rs):

  • Add v2.search_flaky_tests to UNSTABLE_OPS (was missing, caused UnstableOperationDisabledError)

E2E verification (DD_SITE=datad0g.com, OAuth)

Scope Commands tested Result
ci_visibility_read cicd pipelines list/get, events search/aggregate PASS
test_optimization_read cicd tests list/search/aggregate, flaky-tests search PASS
test_optimization_write cicd flaky-tests update (400 not 403) PASS
dora_metrics_write cicd dora patch-deployment (400 not 403) PASS
apm_service_catalog_read service-catalog list, service-catalog get PASS
teams_read on-call teams list/get, memberships list PASS
teams_manage on-call teams create/update/delete PASS

Write commands that return 400 (bad request body) confirm the scope is working — a scope/auth failure would be 401 or 403.

Known issues (pre-existing, not addressed here)

  • cicd flaky-tests search sends an invalid request body (--limit flag is parsed but not passed through)
  • OAuth-created teams start with 0 members, so membership add/update/remove can't be tested via OAuth alone (team-level admin required)

🤖 Generated with Claude Code

Scope changes (tested E2E against datad0g.com with OAuth):
- Remove ci_visibility_pipelines_write (no pup commands use it)
- Remove apm_service_catalog_write (no write commands for service catalog)
- Add test_optimization_read (required for cicd tests list/search/aggregate)
- Add test_optimization_write (required for cicd flaky-tests update)
- Add dora_metrics_write (required for cicd dora patch-deployment)

Bugfix:
- Add v2.search_flaky_tests to UNSTABLE_OPS (was missing, caused
  UnstableOperationDisabledError on cicd flaky-tests search)

E2E verification (DD_SITE=datad0g.com, OAuth):

| Scope                    | Commands tested                              | Result |
|--------------------------|----------------------------------------------|--------|
| ci_visibility_read       | cicd pipelines list/get, events search/agg   | PASS   |
| test_optimization_read   | cicd tests list/search/aggregate             | PASS   |
| test_optimization_read   | cicd flaky-tests search                      | PASS   |
| test_optimization_write  | cicd flaky-tests update (400, not 403)       | PASS   |
| dora_metrics_write       | cicd dora patch-deployment (400, not 403)    | PASS   |
| apm_service_catalog_read | service-catalog list, get                    | PASS   |
| teams_read               | on-call teams list/get, memberships list     | PASS   |
| teams_manage             | on-call teams create/update/delete           | PASS   |

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@srosenthal-dd
Copy link
Owner Author

replaced by datadog-labs#155

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant