The OpenID configuration lists only the scopes the forge grants, and the MCP signup tool says what the setting does #46

Merged

grokbot merged 6 commits from dev/stale-signup-admin-scope into main

2026-10-18 03:55:59 +00:00

grokbot commented

2026-10-17 19:39:37 +00:00

Owner

Problem. /.well-known/openid-configuration listed the scope admin. /oauth/authorize never grants it. The MCP signup tool said "Nothing reads it yet", but #2245 made the doors read the setting.

Root cause. The discovery documents wrote the scopes as literals, apart from the type that decides what authorize grants. The tool text was not changed with #2245.

Fix.

OAUTH_SCOPES = ["ro", "rw"] as const in core/oauth.ts defines OAuthScope and isOAuthScope. The three discovery documents list OIDC_SCOPES and OAUTH_SCOPES from those constants, so they cannot list a scope that authorize does not grant.
The MCP signup tool says what the setting does: open lets anyone in; invite and closed refuse a new account (invite links are not redeemed yet); the first account is never refused.

Test. test/oauth-discovery.test.ts expects scopes_supported to be exactly openid profile email ro rw. test/mcp.test.ts checks the signup tool text. On main: both fail. With the fix: both pass.

Validate (fast). Result: baseline. contain.test.ts, studio-runs.test.ts and web-origins.test.ts also fail on main 1051d451 on this box. tsc passes.

Note: if the invite PR (L1) lands, the words "invite links are not redeemed yet" must change. The PR that lands second changes them.

**Problem.** `/.well-known/openid-configuration` listed the scope `admin`. `/oauth/authorize` never grants it. The MCP `signup` tool said "Nothing reads it yet", but #2245 made the doors read the setting. **Root cause.** The discovery documents wrote the scopes as literals, apart from the type that decides what authorize grants. The tool text was not changed with #2245. **Fix.** - `OAUTH_SCOPES = ["ro", "rw"] as const` in `core/oauth.ts` defines `OAuthScope` and `isOAuthScope`. The three discovery documents list `OIDC_SCOPES` and `OAUTH_SCOPES` from those constants, so they cannot list a scope that authorize does not grant. - The MCP `signup` tool says what the setting does: open lets anyone in; invite and closed refuse a new account (invite links are not redeemed yet); the first account is never refused. **Test.** `test/oauth-discovery.test.ts` expects `scopes_supported` to be exactly `openid profile email ro rw`. `test/mcp.test.ts` checks the `signup` tool text. On main: both fail. With the fix: both pass. **Validate (fast).** Result: baseline. `contain.test.ts`, `studio-runs.test.ts` and `web-origins.test.ts` also fail on main 1051d451 on this box. tsc passes. Note: if the invite PR (L1) lands, the words "invite links are not redeemed yet" must change. The PR that lands second changes them.

grokbot added 1 commit

2026-10-17 19:39:38 +00:00

The OpenID configuration lists only the scopes the forge grants, and the MCP signup tool says what the setting does

check / gate (2) (pull_request) Successful in 3m31s

Details

preview / preview (pull_request) Failing after 1m10s

Details

check / gate (3) (pull_request) Successful in 4m11s

Details

check / gate (1) (pull_request) Successful in 9m57s

Details

check / check (pull_request) Successful in 0s