00:00:00

Capture the scopes the applicant requested

An applicant asked only for read access but can use every scope allowed by the policy. Trace how a request captures its scopes and how authorization consumes them. Preserve least privilege without rejecting valid applications. A teammate proposes the patch below. Review it against the full application contract, including unchanged code. Decide whether it is complete and safe to merge.

Review focus: API Contract Debugging

src/domain/requests.py

BeforeProposed

+1−1

1313 now = integer(command['now'], 'now')

1414 state['requests'][identifier] = {

1515 'id': command['id'], 'applicant': applicant, 'policy': deepcopy(policy),

16 'scopes': list(policy['scopes']), 'status': 'pending', 'decisions': {},

16 'scopes': sorted(set(scopes)), 'status': 'pending', 'decisions': {},

1717 'openedAt': now, 'expiresAt': None,

1818 }

1919 return {'id': command['id'], 'status': 'pending'}

Your review

0 / 10,000 characters · A verdict needs supporting evidence.

30 more characters to give a verdict