From 6366c380fedfb25f687561fb04c543fc63f4461b Mon Sep 17 00:00:00 2001
From: Ethan <39577870+ethanndickson@users.noreply.github.com>
Date: Fri, 5 Jun 2026 01:14:20 +1000
Subject: [PATCH] fix: correct user:* scope typo (#26049)

The wildcard entry in `externalLowLevel` was `"user.*"` (period) instead
of `"user:*"` (colon). Every other entry uses the `resource:action`
colon convention, and `parseLowLevelScope` rejects the period form, so
the wildcard was silently dropped from `ExternalScopeNames()` and could
not be requested via `coder tokens create --scope=user:*`.

Closes https://github.com/coder/coder/issues/25623
---
 coderd/rbac/scopes_catalog.go | 2 +-
 codersdk/apikey_scopes_gen.go | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/coderd/rbac/scopes_catalog.go b/coderd/rbac/scopes_catalog.go
index dc15913faa..04304681a6 100644
--- a/coderd/rbac/scopes_catalog.go
+++ b/coderd/rbac/scopes_catalog.go
@@ -44,7 +44,7 @@ var externalLowLevel = map[ScopeName]struct{}{
 	"user:read":            {},
 	"user:read_personal":   {},
 	"user:update_personal": {},
-	"user.*":               {},
+	"user:*":               {},
 
 	// User secrets
 	"user_secret:read":   {},
diff --git a/codersdk/apikey_scopes_gen.go b/codersdk/apikey_scopes_gen.go
index 450a5221f0..f227129816 100644
--- a/codersdk/apikey_scopes_gen.go
+++ b/codersdk/apikey_scopes_gen.go
@@ -272,6 +272,7 @@ var PublicAPIKeyScopes = []APIKeyScope{
 	APIKeyScopeTemplateRead,
 	APIKeyScopeTemplateUpdate,
 	APIKeyScopeTemplateUse,
+	APIKeyScopeUserAll,
 	APIKeyScopeUserRead,
 	APIKeyScopeUserReadPersonal,
 	APIKeyScopeUserUpdatePersonal,