Fix: Add scopes for devkeys #10984

Meldiron · 2025-12-18T11:31:38Z

What does this PR do?

Currently project scopes were re-used; separating scopes gives more flexibility

Test Plan

Current tests must pass

Related PRs and Issues

x

Checklist

Have you read the Contributing Guidelines on issues?
If the PR includes a change to an API's metadata (desc, label, params, etc.), does it also include updated API specs and example docs?

coderabbitai · 2025-12-18T11:31:58Z

📝 Walkthrough

Walkthrough

This change introduces new granular authorization scopes for developer key operations. The roles configuration file grants admin users two new permissions: devKeys.read and devKeys.write. Concurrently, five HTTP endpoints managing developer key operations (Get, List, Create, Update, Delete) are updated to use these new scope labels instead of the broader projects.read and projects.write scopes, implementing fine-grained access control for dev key management.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Rationale: The changes follow a consistent, repetitive pattern across multiple files. Each endpoint modification is identical in nature (single scope label replacement), and the roles configuration addition is straightforward. No logic, error handling, or control flow modifications are present. The homogeneity of changes across six files reduces per-file review complexity.
Areas to verify:
- Confirm the new scopes (devKeys.read, devKeys.write) are correctly applied to their respective operations (read vs. write)
- Verify that all five DevKeys endpoints have been updated (no missed endpoints)
- Ensure the admin role in roles.php includes both new scopes and no other unintended additions

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run `@coderabbitai generate docstrings` to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change—adding new scopes for devkeys—and directly reflects the core purpose of the PR.
Description check	✅ Passed	The description explains the motivation (separating scopes for flexibility) and testing approach, and is clearly related to the changeset.

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix-devkey-scopes

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 9bda831 and 7dea3f1.

📒 Files selected for processing (6)

app/config/roles.php (1 hunks)
src/Appwrite/Platform/Modules/Projects/Http/DevKeys/Create.php (1 hunks)
src/Appwrite/Platform/Modules/Projects/Http/DevKeys/Delete.php (1 hunks)
src/Appwrite/Platform/Modules/Projects/Http/DevKeys/Get.php (1 hunks)
src/Appwrite/Platform/Modules/Projects/Http/DevKeys/Update.php (1 hunks)
src/Appwrite/Platform/Modules/Projects/Http/DevKeys/XList.php (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)

GitHub Check: Setup & Build Appwrite Image
GitHub Check: Setup & Build Appwrite Image
GitHub Check: scan

🔇 Additional comments (6)

src/Appwrite/Platform/Modules/Projects/Http/DevKeys/Create.php (1)

37-37: LGTM! Scope change aligns with fine-grained authorization.

The migration from projects.write to devKeys.write correctly scopes this CREATE endpoint to developer key operations.

src/Appwrite/Platform/Modules/Projects/Http/DevKeys/Get.php (1)

31-31: LGTM! Scope change correctly implements read-only authorization.

The migration from projects.read to devKeys.read properly scopes this GET endpoint to developer key read operations.

src/Appwrite/Platform/Modules/Projects/Http/DevKeys/XList.php (1)

35-35: LGTM! List endpoint correctly uses read scope.

The migration from projects.read to devKeys.read appropriately scopes this list endpoint to developer key read operations.

src/Appwrite/Platform/Modules/Projects/Http/DevKeys/Update.php (1)

32-32: LGTM! Update endpoint correctly uses write scope.

The migration from projects.write to devKeys.write properly scopes this UPDATE endpoint to developer key write operations.

src/Appwrite/Platform/Modules/Projects/Http/DevKeys/Delete.php (1)

31-31: LGTM! Delete endpoint correctly uses write scope.

The migration from projects.write to devKeys.write appropriately scopes this DELETE endpoint to developer key write operations.

app/config/roles.php (1)

61-62: LGTM! New scopes correctly added to admin roles.

The addition of devKeys.read and devKeys.write scopes to the $admins array correctly grants Admin, Developer, and Owner roles access to the devKeys endpoints. All devKeys endpoints (Create, Delete, Get, Update, XList) are properly configured with auth: [AuthType::ADMIN] and use the correct scope labels. The placement after keys.write provides logical grouping, and excluding these scopes from the $member array is appropriate since all endpoints require admin authentication.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2025-12-18T11:34:06Z

Security Scan Results for PR

Docker Image Scan Results

Package	Version	Vulnerability	Severity
libpng	1.6.51-r0	CVE-2025-66293	HIGH
libpng-dev	1.6.51-r0	CVE-2025-66293	HIGH

Source Code Scan Results

🎉 No vulnerabilities found!

github-actions · 2025-12-18T11:42:46Z

✨ Benchmark results

Requests per second: 1,187
Requests with 200 status code: 213,743
P99 latency: 0.163221802

⚡ Benchmark Comparison

Metric	This PR	Latest version
RPS	1,187	1,275
200	213,743	229,632
P99	0.163221802	0.160548084

Copilot

Pull request overview

This PR introduces separate scopes for dev keys operations to provide more granular access control. Previously, dev keys endpoints reused the generic projects.read and projects.write scopes, which lacked the flexibility to manage dev keys permissions independently from general project permissions.

Key Changes:

Replaced projects.read and projects.write scopes with dedicated devKeys.read and devKeys.write scopes across all dev keys endpoints
Registered the new scopes in the application's role configuration

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/Appwrite/Platform/Modules/Projects/Http/DevKeys/XList.php	Updated list endpoint to use `devKeys.read` scope
src/Appwrite/Platform/Modules/Projects/Http/DevKeys/Get.php	Updated get endpoint to use `devKeys.read` scope
src/Appwrite/Platform/Modules/Projects/Http/DevKeys/Create.php	Updated create endpoint to use `devKeys.write` scope
src/Appwrite/Platform/Modules/Projects/Http/DevKeys/Update.php	Updated update endpoint to use `devKeys.write` scope
src/Appwrite/Platform/Modules/Projects/Http/DevKeys/Delete.php	Updated delete endpoint to use `devKeys.write` scope
app/config/roles.php	Registered new `devKeys.read` and `devKeys.write` scopes

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Add scopes for devkeys

7dea3f1

Meldiron requested a review from Copilot December 18, 2025 11:43

Copilot started reviewing on behalf of Meldiron December 18, 2025 11:43 View session

Copilot AI reviewed Dec 18, 2025

View reviewed changes

eldadfux approved these changes Dec 18, 2025

View reviewed changes

Meldiron merged commit 9fb1aaa into 1.8.x Dec 18, 2025
49 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix: Add scopes for devkeys #10984

Fix: Add scopes for devkeys #10984

Meldiron commented Dec 18, 2025

Uh oh!

coderabbitai bot commented Dec 18, 2025 •

edited

Loading

Walkthrough

Estimated code review effort

Uh oh!

github-actions bot commented Dec 18, 2025

Uh oh!

github-actions bot commented Dec 18, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Fix: Add scopes for devkeys #10984

Fix: Add scopes for devkeys #10984

Conversation

Meldiron commented Dec 18, 2025

What does this PR do?

Test Plan

Related PRs and Issues

Checklist

Uh oh!

coderabbitai bot commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Estimated code review effort

Pre-merge checks and finishing touches

Uh oh!

github-actions bot commented Dec 18, 2025

Security Scan Results for PR

Docker Image Scan Results

Source Code Scan Results

Uh oh!

github-actions bot commented Dec 18, 2025

✨ Benchmark results

⚡ Benchmark Comparison

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai bot commented Dec 18, 2025 •

edited

Loading