Skip to content

Fix OAuth scope satisfaction to AND-of-ORs (required means required) #2778

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
SamMorrowDrums wants to merge 7 commits into from
Closed

Fix OAuth scope satisfaction to AND-of-ORs (required means required) #2778

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
0de95e0
Fix OAuth scope satisfaction to AND-of-ORs (required means required)
SamMorrowDrums Jun 26, 2026
e10fbfe
Document scope-filter limitations and fail-open posture
SamMorrowDrums Jun 26, 2026
02e9ccf
docs(scope-filtering): expand limitations and fail-open posture
SamMorrowDrums Jun 26, 2026
447ede0
test(scopes): pin deliberate OAuth scope-model assumptions
SamMorrowDrums Jun 29, 2026
daad4fd
Apply suggestion from @SamMorrowDrums
SamMorrowDrums Jul 16, 2026
7c1d249
Apply suggestion from @SamMorrowDrums
SamMorrowDrums Jul 16, 2026
ac8566b
Apply suggestion from @SamMorrowDrums
SamMorrowDrums Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Apply suggestion from @SamMorrowDrums
  • Loading branch information
@SamMorrowDrums
SamMorrowDrums authored Jul 16, 2026
commit 7c1d24930d7996595c1767e22aa836cbebe7a0aa
1 change: 0 additions & 1 deletion docs/scope-filtering.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,6 @@ A tool's declared scopes are **all required** (logical AND), and each one may be
- **Organization roles.** A *security manager* (or similar) org role grants access orthogonally to OAuth scopes and is invisible to scope filtering.
- **Other token types.** Fine-grained PATs, OAuth, and GitHub App tokens use different permission models; filtering is skipped for them entirely (gated to `ghp_`), which is fail-open by design.

These cases are deferred to runtime API enforcement. If precise sibling-OR modeling is ever needed, the extension point is making the required scopes a list of OR-groups (AND across groups, OR within a group) — deliberately not built yet.

## Classic vs Fine-Grained Personal Access Tokens

Expand Down
Loading