pup: enable OAuth for ASM WAF commands - #757
Conversation
Switch 10 ASM WAF functions in security.rs from make_api_no_auth! to make_api! so they send the OAuth bearer token. Add appsec_protect_read and appsec_protect_write to the OAuth scope list in auth/types.rs. Server-side dependency: the ASM WAF routes in dd-go rc-api need to accept OAuth at the gateway level. This is currently blocked pending investigation with the remote-config team (DAL-743).
…th-asm-waf # Conflicts: # src/auth/types.rs
Add a mockito test that drives all ten ASM WAF operations (custom rules and exclusion filters: list/get/create/update/delete) against an OAuth-only config (bearer token, no API/APP keys) and asserts each request carries the Authorization: Bearer header. Add scope tests locking appsec_protect_read into read_only_scopes() and both appsec_protect scopes into default_scopes().
…th-asm-waf # Conflicts: # src/auth/types.rs
|
E2E validated with a local release build of this branch against datadoghq.com, using a fresh OAuth login that includes the new scopes:
All four read-only commands authenticate via the OAuth bearer token end-to-end. Write commands (create/update/delete) weren't exercised to avoid mutating live rules. (from Claude Code) |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3ac29c6c19
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
2 participants
Summary
Switch 10 ASM WAF functions in
security.rsfrommake_api_no_auth!tomake_api!so they send the OAuth bearer token. Addappsec_protect_readandappsec_protect_writeto the OAuth scope list inauth/types.rs.Server-side dependency
The ASM WAF routes are in dd-go's rc-api service (chi router, JWT-based auth from the API gateway). The server-side gap is at the gateway level -- the rc-api service itself has no per-route authn method configuration. This is blocked pending investigation with the remote-config team (DAL-743).
Changes
src/commands/security.rs: 10make_api_no_auth!->make_api!swaps (5asm_custom_rules_*+ 5asm_exclusions_*)src/auth/types.rs: Addedappsec_protect_readandappsec_protect_writeto the OAuth scope list