Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[TB] add OAuth entry #20049

Merged
merged 1 commit into from
Jul 19, 2024
+12 −0
Merged

[TB] add OAuth entry #20049

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions components/server/src/oauth-server/db.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,17 @@ const desktopClient: OAuthClient = {
],
};

const toolbox: OAuthClient = {
id: "toolbox-gateway-gitpod-plugin",
name: "JetBrains Toolbox Gitpod Plugin",
redirectUris: ["jetbrains://gateway/io.gitpod.toolbox.gateway/auth"],
allowedGrants: ["authorization_code"],
scopes: [
// We scope all so that it can work in papi like a PAT
{ name: "function:*" },
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe still makes sense revisiting after we decide what methods are important to scope this down? Or is that not possible with p-api?

Copy link
Contributor Author

@mustard-mh mustard-mh Jul 19, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you, we have reason to set it to all scopes #20049 (comment) for now

Comment on lines +150 to +151
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💭 Is it necessary to whitelist all scopes or can we limit it to some extent of internal functions, like we did for the other clients?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes we do, because we need to use papi v1 entry. #19597 (comment)

We can update it anyway in the future

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For more context, the limitation is here

gitpod/components/server/src/auth/bearer-authenticator.ts

Lines 115 to 119 in 8df5d2f

// gpl: Once we move PAT to FGA-backed scopes, this special case will go away, and covered by a different SubjectIdKind.
const { isAllAccessFunctionGuard } = FunctionAccessGuard.extractFunctionScopes(scopes);
if (!isAllAccessFunctionGuard) {
return undefined;
}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But I have no idea when we can do it

],
};

const vscode = createVSCodeClient("vscode", "VS Code");
const vscodeInsiders = createVSCodeClient("vscode-insiders", "VS Code Insiders");

Expand All @@ -157,6 +168,7 @@ export const inMemoryDatabase: InMemory = {
[vscodium.id]: vscodium,
[cursor.id]: cursor,
[desktopClient.id]: desktopClient,
[toolbox.id]: toolbox,
},
tokens: {},
scopes: {},
Expand Down
Loading