This PR adds wildcard API key scopes (resource:*) for all RBAC resources to ensure every resource has a matching wildcard value. It also adds all individualresource:action scopes to the API documentation and TypeScript definitions.

The changes include:

Adding a new database migration (000377) that adds wildcard API key scopes
Updating the API documentation to include all available scopes
Enhancing the scope generation scripts to include all resource wildcards
Updating the TypeScript definitions to match the expanded scope list

These changes make creating API keys with comprehensive permissions for specific resource types easier.

github-actionsbot assignedThomasK33

Sep 30, 2025

Copy link

MemberAuthor

ThomasK33 commentedSep 30, 2025•
edited
Loading

This stack of pull requests is managed byGraphite. Learn more aboutstacking.

This was referencedSep 30, 2025

feat: add allow_list to resource-scoped API tokens#19964

Open

feat: add scope enforcement metrics to RBAC authorizer#19991

Draft

feat: add allow list to API keys#19972

Open

feat: add API endpoint to update token API keys#19983

Open

feat: add scoped token support to CLI#19985

Open

fix: improve RBAC scope allow list handling for create actions#20008

Open

feat: add API key metadata to audit logs#19996

Draft

feat: add legacy API key scope compatibility#20021

Open

ThomasK33 changed the title~~feat: implement composite API key scopes for workspaces and templates (#19945)~~refactor: add wildcard scope entries for API key scopes

Sep 30, 2025

ThomasK33 force-pushed thethomask33/09-30-add_wildcard_scope_entries_for_api_keys branch frombf7dc20 to1f8b5f6Compare

September 30, 2025 11:14

ThomasK33 marked this pull request as ready for review

September 30, 2025 13:10

ThomasK33 requested review fromEmyrk andaslilac

September 30, 2025 13:10

ThomasK33 mentioned this pull request

Sep 30, 2025

feat: improve RBAC resource ID matching and structured allowlist targets#20035

Draft

ThomasK33 force-pushed thethomask33/09-30-add_wildcard_scope_entries_for_api_keys branch from1f8b5f6 to67e3e31Compare

September 30, 2025 14:02

Emyrk approved these changes

Sep 30, 2025

View reviewed changes

scripts/generate_api_key_scope_enum/main.go OutdatedShow resolvedHide resolved

ThomasK33 force-pushed thethomask33/09-30-add_wildcard_scope_entries_for_api_keys branch 7 times, most recently frombf0f8e8 to515bfd7Compare

October 3, 2025 17:59

refactor: add wildcard scope entries for API key scopes

5884dbd

Added resource:* wildcard entries to api_key_scope enum for all RBACresources, ensuring each resource has a complete set of action-specificscopes plus a wildcard. Updated code generation scripts to synthesizewildcards from policy.RBACPermissions and include all built-in andcomposite scope names. This change ensures the database enum supportsthe full set of scope names required by the RBAC system, improvingconsistency between RBAC permissions and API key scopes.

ThomasK33 force-pushed thethomask33/09-30-add_wildcard_scope_entries_for_api_keys branch from515bfd7 to5884dbdCompare

October 6, 2025 09:42

ThomasK33 merged commitb60ae0a intomain

Oct 6, 2025

36 checks passed