Ehab Younes fc01bee831 fix: keep new API keys within the caller's scopes and allow list (#30256) ...

A scoped key holding api_key:create could mint a broader key, e.g. a token scoped to [api_key:create user:read] could mint coder:all.

- New keys must be covered by the caller's scopes and allow list, and inherit them when none are requested
- Requests beyond the caller return 403
- New key expiry is capped at the caller's
- Covers POST /users/{user}/keys/tokens, POST /users/{user}/keys, app auth-redirect, and /oauth2/authorize (invalid_scope on excess grants or a restricted session allow list)
- coder:all sessions, including browser logins, behave as before
- Not addressed: workspace start still mints a coder:all key for the owner

2026-10-07 11:43:19 +03:00

..

apikey_test.go

fix: canonicalize API key scope aliases at ingress (#28322)

2026-08-25 17:12:51 -07:00

apikey.go

fix: keep new API keys within the caller's scopes and allow list (#30256)

2026-10-07 11:43:19 +03:00