NotificationsYou must be signed in to change notification settings
Fork1k
Star11.1k

feat: scope allow_list to include`resource_type`#19748

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

Emyrk merged 6 commits intomainfromstevenmasley/better_allow_list

Sep 17, 2025

Merged

feat: scope allow_list to include`resource_type`#19748

Emyrk merged 6 commits intomainfromstevenmasley/better_allow_list

Sep 17, 2025

+203 −24

Conversation

Copy link

Member

Emyrk commentedSep 9, 2025•
edited
Loading

This feature allows theallow_list in the scopes to specify thetype of a resource as well. So this is now possible:

allowList= [// Only access to this specific workspace  {"type":"workspace","id":"<uuid>"},// But all templates  {"type":"template","id":"*"},]

This was added in support of custom scopes, primarily for AI agents. There is a need to add a scope that restricts an API key to accessing a specific workspace. With this, we can exhaustively enumerate the other resources required for functionality.

Example:

allowList = [  // Only access to this specific workspace  {"type":"workspace", "id":"<uuid>"},  // Leave the rest of the permissions  {"type":"template", "id":"*"},  {"type":"user", "id":"*"},  {"type":"organization", "id":"*"},   {"type":"group", "id":"*"},  // ... etc ]

This is unfortunate that the list has to be exhaustive.