check-scopes

Validates that the DB enumapi_key_scope contains every<resource>:<action> derived fromcoderd/rbac/policy/RBACPermissions.

• Exits 0 when all scopes are present incoderd/database/dump.sql.
• Exits 1 and prints missing values with suggestedALTER TYPE statements otherwise.

Usage

Ensure the schema dump is up-to-date, then run the check:

make -B gen/db   # forces DB dump regenerationmake lint/check-scopes

Or directly:

go run ./tools/check-scopes

Optional flags:

• -dump path — override path todump.sql (defaultcoderd/database/dump.sql).

Remediation

When the tool reports missing values:

1. Create a DB migration extending the enum, e.g.:

   ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'template:view_insights';

2. Regenerate and re-run:

   make -B gen/db && make lint/check-scopes

3. Decide whether each new scope is public (exposed in the catalog) or internal-only.

   • If public, add it to the curated map incoderd/rbac/scopes_catalog.go (externalLowLevel) so it appears in the public catalog and can be requested by users.

There is no documentation for this package.