feat: implement API key scopes database migration #19861
Merged
+1,252
−71
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ThomasK33
force-pushed
the
thomask33/19845-database-migrations-scopes-array-typed-allow-list
branch
from
2ba5550 to
e548168
Compare
ThomasK33
changed the title
ThomasK33
changed the title
ThomasK33
force-pushed
the
thomask33/19845-database-migrations-scopes-array-typed-allow-list
branch
3 times, most recently
from
7a7e6ad to
1aba733
Compare
ThomasK33
changed the base branch from
main
to
thomask33/nix-flake-node-bump
ThomasK33
force-pushed
the
thomask33/19845-database-migrations-scopes-array-typed-allow-list
branch
from
1aba733 to
99b5b53
Compare
Emyrk
previously requested changes
Sep 18, 2025
coderd/database/migrations/000371_api_key_scopes_array_allow_list.up.sql
Show resolved
Hide resolved
ThomasK33
force-pushed
the
thomask33/19845-database-migrations-scopes-array-typed-allow-list
branch
from
99b5b53 to
db8b42e
Compare
ThomasK33
force-pushed
the
thomask33/nix-flake-node-bump
branch
from
241294b to
70b3a9f
Compare
ThomasK33
force-pushed
the
thomask33/nix-flake-node-bump
branch
4 times, most recently
from
3622f3e to
3e3a767
Compare
ThomasK33
force-pushed
the
thomask33/19845-database-migrations-scopes-array-typed-allow-list
branch
from
db8b42e to
32e7137
Compare
ThomasK33
force-pushed
the
thomask33/19845-database-migrations-scopes-array-typed-allow-list
branch
from
32e7137 to
682511c
Compare
ThomasK33
dismissed
Emyrk’s stale review
removing you, since I goofed up the git history and don't want to spam you. will rerequest in the future
ThomasK33
force-pushed
the
thomask33/nix-flake-node-bump
branch
from
3e3a767 to
4e7f6cb
Compare
ThomasK33
force-pushed
the
thomask33/19845-database-migrations-scopes-array-typed-allow-list
branch
from
0fd28db to
a1e7294
Compare
ThomasK33
changed the base branch from
thomask33/nix-flake-node-bump
to
graphite-base/19861
ThomasK33
force-pushed
the
thomask33/19845-database-migrations-scopes-array-typed-allow-list
branch
from
a1e7294 to
81ce34a
Compare
ThomasK33
force-pushed
the
graphite-base/19861
branch
from
96684bf to
4d8dc22
Compare
ThomasK33
force-pushed
the
thomask33/19845-database-migrations-scopes-array-typed-allow-list
branch
4 times, most recently
from
ae36958 to
391fa21
Compare
ThomasK33
force-pushed
the
thomask33/19845-database-migrations-scopes-array-typed-allow-list
branch
2 times, most recently
from
5b28178 to
ec2d8fb
Compare
This was referenced Sep 22, 2025
ThomasK33
force-pushed
the
thomask33/19845-database-migrations-scopes-array-typed-allow-list
branch
from
ec2d8fb to
782f1c7
Compare
Emyrk
reviewed
Sep 22, 2025
Emyrk
reviewed
Sep 22, 2025
Emyrk
approved these changes
Sep 22, 2025
ThomasK33
force-pushed
the
thomask33/19845-database-migrations-scopes-array-typed-allow-list
branch
2 times, most recently
from
0eb0644 to
81b483f
Compare
…w list Replace the single `scope` column with `scopes` array and add `allow_list` column to API keys table. This enables fine-grained authorization control using low-level resource:action permissions while maintaining backward compatibility. - Add database migration extending api_key_scope enum with all RBAC permissions - Replace APIKey.Scope with APIKey.Scopes array and AllowList fields - Implement APIKeyScopes.Expand() method for multi-scope authorization - Add AllowList type with database serialization support - Update RBAC scope expansion to support resource:action format - Maintain response compatibility by deriving single scope from arrays - Add comprehensive test coverage for scope expansion logic
ThomasK33
force-pushed
the
thomask33/19845-database-migrations-scopes-array-typed-allow-list
branch
from
81b483f to
b27f312
Compare
ThomasK33
deleted the
thomask33/19845-database-migrations-scopes-array-typed-allow-list
branch
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Added database migration for API key scopes.
Fixes #19845