feat(core): add scope support for client creds by c-r33d · Pull Request #752 · opentdf/otdfctl

c-r33d · 2026-02-19T16:47:31Z

1.) Add scopes support when using client creds to auth.
2.) Bump SDK to v0.13
3.) Bump golangci-lint to v2.10.1

gemini-code-assist · 2026-02-19T16:47:53Z

Summary of Changes

Hello @c-r33d, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the client credentials authentication flow by introducing support for OAuth scopes, enabling users to define specific permissions during authentication. Concurrently, it updates the project's Go SDK and other core dependencies, ensuring the application remains current with the latest platform features and improvements.

Highlights

Client Credentials Scopes: Implemented support for specifying OAuth scopes when using client credentials for authentication, allowing for more granular access control.
SDK and Dependency Updates: Upgraded the project's Go SDK to version v0.13 and updated other related Go module dependencies to their latest versions.
Documentation Enhancement: Updated the command-line documentation to reflect the new scopes flag and its usage for client credentials.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

cmd/auth/clientCredentials.go
- Declared a new global variable clientCredScopes to hold scope values.
- Modified clientCredentialsRun to conditionally retrieve scopes from the profile or use the provided flag, and to store them in the authentication credentials.
- Added a StringSliceVar flag for scopes to the client-credentials command.
cmd/common/common.go
- Updated the SetAuthCredentials call to include the Scopes field when processing client credentials.
docs/man/_index.md
- Updated descriptions for with-client-creds-file and with-client-creds flags to indicate that scopes are now an optional part of the JSON configuration.
docs/man/auth/client-credentials.md
- Added a new flags section to document the scopes flag, detailing its purpose and behavior.
- Included an example demonstrating how to use the client-credentials command with explicit scopes.
go.mod
- Updated the Go language version from 1.24.0 to 1.25.0.
- Bumped github.com/opentdf/platform/lib/ocrypto from v0.9.0 to v0.10.0.
- Bumped github.com/opentdf/platform/protocol/go from v0.15.0 to v0.16.0.
- Bumped github.com/opentdf/platform/sdk from v0.12.0 to v0.13.0.
go.sum
- Updated checksums for the bumped Go module dependencies.
pkg/auth/auth.go
- Added a Scopes field ([]string) to the ClientCredentials struct.
- Introduced normalizeScopes and normalizeClientCredScopes functions for processing and cleaning scope strings.
- Applied scope normalization when reading client credentials from file and JSON.
- Modified GetSDKAuthOptionFromProfile, ValidateProfileAuthCredentials, and GetTokenWithClientCreds to accept and utilize the scopes parameter.
- Updated GetTokenWithClientCreds to set the 'scope' parameter in the OAuth2 client credentials request if scopes are provided.
pkg/profiles/profileAuthCreds.go
- Added a Scopes field ([]string) to the AuthCredentials struct.

Activity

No human activity has been recorded on this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds support for scopes when using client credentials for authentication. The changes look good and cover the necessary updates in command-line handling, authentication logic, and documentation. I've added a few suggestions to improve the implementation by removing a package-level variable and simplifying some of the new logic.

cmd/auth/clientCredentials.go

pkg/auth/auth.go

c-r33d · 2026-02-19T17:13:59Z

/gemini review

gemini-code-assist

Code Review

The pull request successfully introduces scope support for client credentials authentication. However, there are critical issues in the go.mod file regarding the Go version and an unintentional dependency downgrade. Additionally, I recommend exporting the scope normalization logic to ensure consistency between the CLI input and the stored profile data.

go.mod

pkg/auth/auth.go

cmd/auth/clientCredentials.go

github-actions · 2026-02-19T17:41:35Z

X-Test Failure Report

bats-test-results
test-cases-mapping-report

github-actions · 2026-02-19T17:43:30Z

X-Test Failure Report

github-actions · 2026-02-19T18:04:03Z

X-Test Results

bats-test-results
test-cases-mapping-report
✅ js-v0.9.0
✅ js-main
✅ java-v0.9.0
✅ java-main
✅ go-v0.9.0
✅ go-main

github-actions · 2026-02-19T20:57:56Z

X-Test Results

bats-test-results
test-cases-mapping-report
✅ js-main
✅ js-v0.9.0
✅ java-v0.9.0
✅ java-main
✅ go-v0.9.0
✅ go-main

docs/man/auth/client-credentials.md

Co-authored-by: Jake Van Vorhis <83739412+jakedoublev@users.noreply.github.com>

github-actions · 2026-02-19T21:19:34Z

X-Test Results

bats-test-results
test-cases-mapping-report
✅ js-v0.9.0
✅ js-main
✅ java-v0.9.0
✅ java-main
✅ go-v0.9.0
✅ go-main

add scope support for client creds.

50706f0

c-r33d requested review from a team as code owners February 19, 2026 16:47

Merge branch 'main' into otdfctl-with-okta

df3c6b0

c-r33d changed the title ~~add scope support for client creds.~~ feat(core): add scope support for client creds Feb 19, 2026

gemini-code-assist bot reviewed Feb 19, 2026

View reviewed changes

cmd/auth/clientCredentials.go Outdated Show resolved Hide resolved

cmd/auth/clientCredentials.go Outdated Show resolved Hide resolved

pkg/auth/auth.go Show resolved Hide resolved

c-r33d added 2 commits February 19, 2026 10:57

bump to latest golangci-lint.

321094b

gemini comments.

dc00d88

fetch depth 0.

c4a4d9e

gemini-code-assist bot reviewed Feb 19, 2026

View reviewed changes

c-r33d added 3 commits February 19, 2026 11:27

suggestions.

fdb21d0

ignore lint.

d8a2112

toolchain to 1.25.7

98f4f3f

change docs.

5fc5622

c-r33d enabled auto-merge (squash) February 19, 2026 18:06

c-r33d disabled auto-merge February 19, 2026 19:21

Merge branch 'main' into otdfctl-with-okta

3dc2a9f

jakedoublev reviewed Feb 19, 2026

View reviewed changes

docs/man/auth/client-credentials.md Outdated Show resolved Hide resolved

jakedoublev previously approved these changes Feb 19, 2026

View reviewed changes

Update docs/man/auth/client-credentials.md

3c9e1ed

Co-authored-by: Jake Van Vorhis <83739412+jakedoublev@users.noreply.github.com>

c-r33d dismissed jakedoublev’s stale review via 3c9e1ed February 19, 2026 20:58

c-r33d enabled auto-merge (squash) February 19, 2026 20:58

jakedoublev approved these changes Feb 19, 2026

View reviewed changes

c-r33d merged commit 9ca9e43 into main Feb 19, 2026
20 checks passed

c-r33d deleted the otdfctl-with-okta branch February 19, 2026 21:19

opentdf-automation bot mentioned this pull request Feb 19, 2026

chore(main): release 0.30.0 #748

Open

Conversation

c-r33d commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot commented Feb 19, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

c-r33d commented Feb 19, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Feb 19, 2026

X-Test Failure Report

Uh oh!

github-actions bot commented Feb 19, 2026

X-Test Failure Report

Uh oh!

github-actions bot commented Feb 19, 2026

X-Test Results

Uh oh!

github-actions bot commented Feb 19, 2026

X-Test Results

Uh oh!

Uh oh!

github-actions bot commented Feb 19, 2026

X-Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

c-r33d commented Feb 19, 2026 •

edited

Loading