Platform-only deploy/delete require app-engine:apps:run just to discover an unused classic URL

[sergiohinojosa]

Summary

With platform credentials only (a platform token or OAuth, no accessToken), every deploy, delete, purge and download first calls GET /platform/metadata/v1/classic-environment-domain. That call needs app-engine:apps:run. The classic URL it returns is only used to build the classic (access-token) client, which a platform-only manifest never creates.

So a platform token scoped to exactly what the project deploys (documents and settings) is refused before any work starts:

could not authorize against environment '…' using platform credentials: … may be missing required scope 'app-engine:apps:run'

Why this matters

app-engine:apps:run is not a configuration permission. It lets the bearer call the backend functions of every app installed in the environment. We hand Monaco to learners in hands-on trainings, on a short-lived platform token scoped to documents and settings. Adding app-engine:apps:run to that token would let a learner call other apps' functions as the token's principal, just so Monaco can look up a URL it then does not use.

Where (v2.30.1)

• pkg/client/clientset.go:340: CreateClientSetWithOptions calls metadata.GetDynatraceClassicURL whenever platform credentials are given. The result is only consumed by the if auth.AccessToken != nil block that follows.
• cmd/monaco/dynatrace/dynatrace.go:69: VerifyEnvironmentAuthentication resolves the classic URL the same way before deploy. (MONACO_FEAT_SIMPLE_CLASSIC_URL helps here, but not at clientset.go:340, which has no flag.)
• An OAuth manifest takes the same path. No manifest field or feature flag supplies the classic URL.

Proposed change

Discover the classic URL only when it is needed, i.e. when an access token is configured:

--- a/pkg/client/clientset.go
+++ b/pkg/client/clientset.go
@@ -337,9 +337,13 @@ func CreateClientSetWithOptions(ctx context.Context, url string, auth manifest.A
-		classicURL, err = metadata.GetDynatraceClassicURL(ctx, *client)
-		if err != nil {
-			return nil, err
+		// The classic URL is only needed for the access-token (classic API) client below.
+		// Discovering it needs 'app-engine:apps:run', which a platform-only setup may lack.
+		if auth.AccessToken != nil {
+			classicURL, err = metadata.GetDynatraceClassicURL(ctx, *client)
+			if err != nil {
+				return nil, err
+			}
 		}
--- a/cmd/monaco/dynatrace/dynatrace.go
+++ b/cmd/monaco/dynatrace/dynatrace.go
@@ -64,7 +64,7 @@ func VerifyEnvironmentAuthentication(ctx context.Context, env manifest.Environme
-	if env.HasPlatformCredentials() {
+	if env.HasPlatformCredentials() && env.Auth.AccessToken != nil {

go test ./pkg/client/ passes. Side effect: a platform-only run no longer does the up-front auth probe, so a bad token fails on its first real API call, which already reports the error.

Tested on a gen3 environment with a platform token holding only document, settings and DQL read scopes (no app-engine:apps:run):

• stock v2.30.1: refused before deploying (as above);
• patched build: deploy creates a dashboard document plus a settings object, and delete removes both, twice in a row.

(Fully cleaning up a deleted document also needs document:trash.documents:delete, which is expected.)

We are happy to open a PR with tests if this direction is acceptable. Would you prefer this guard, or an explicit manifest/env option for the classic URL?

[arthurpitman]

Hi @sergiohinojosa, thank you for the suggestion! At first glance, this looks like a very sensible change, avoiding the classic environment completely where it is not needed (or available). I'll check it with the team and get back to you!