fix(api): standardize lease/claim scopes to singular#227
Conversation
…laim:write) The scoped-keys taxonomy used plural `leases:write` / `claims:write`, but the pre-existing convention — the v2 lease/claim route guards (scopedAuth), the capability-token scopes, and already-issued as_cap_ tokens — uses singular `lease:write` / `claim:write`. The mismatch meant a key granted the plural scope from the dashboard/API was rejected (403) by the actual leases/claims routes, and couldn't mint capability tokens for them. Standardize on the existing singular form everywhere the plural was introduced (scopes taxonomy, shared ApiScope type, dashboard scope catalog + docs, MCP tools, stdio MCP, docs, llms.txt/agents.md/openapi content) and remove the now -unneeded normalization shims (mcp-auth normalizeToApiScopes, tools capabilityToApiScope). One canonical scope form across keys, capability tokens, routes, and MCP — no mapping. Adds a regression test: a key scoped to lease:write can use the leases route. Co-Authored-By: Duyet Le <[email protected]> Co-Authored-By: duyetbot <[email protected]>
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request standardizes the authorization scopes for leases and claims from plural (leases:write, claims:write) to singular (lease:write, claim:write) across all documentation, API definitions, dashboard components, and MCP packages. This change unifies the scope format, allowing the removal of legacy normalization helper functions in the API middleware and tools. Feedback suggests updating a test comment in packages/api/test/mcp.test.ts that still incorrectly refers to the lease tool's scope as plural.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
|
||
| // The token's singular lease:write must satisfy the lease tool's plural | ||
| // leases:write requiredScope, or capability-token delegation is broken. | ||
| // lease:write requiredScope, or capability-token delegation is broken. |
There was a problem hiding this comment.
The comment on line 182 still refers to the lease tool's scope as 'plural', but it has been standardized to the singular lease:write on line 183. Please update the comment on line 182 to say 'singular' (or remove 'plural') to avoid contradiction and confusion.
|
Warning Review limit reached
More reviews will be available in 44 minutes and 54 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (17)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Bug
The scoped-keys taxonomy introduced plural
leases:write/claims:write, but the pre-existing convention uses singularlease:write/claim:write:scopedAuth({ scope: "lease:write" })/"claim:write"),CAPABILITY_SCOPES) and already-issuedas_cap_tokens.So a key granted the plural scope from the dashboard/API was rejected (403) by the actual leases/claims REST routes, and couldn't mint capability tokens for them. A normalization shim had patched only the MCP path, leaving REST broken.
Fix
Standardize on the existing singular form everywhere the plural was introduced (can't change the other way —
as_cap_tokens are already issued with singular scopes):lib/scopes.ts, sharedApiScope, dashboard scope catalog + in-app docs, MCP tools, stdio@agentstate/mcp,docs/*.md, andllms.txt/agents.md/static.tscontent. Removed the now-redundant shims (normalizeToApiScopes,capabilityToApiScope). One canonical scope form across keys, capability tokens, routes, and MCP — no mapping.Verification
lease:write-scoped key can use the leases route).Co-Authored-By: Duyet Le [email protected]
Co-Authored-By: duyetbot [email protected]