Skip to content

feat: allow customizing oidc scope per integration#7441

Merged
XiNiHa merged 14 commits into
mainfrom
CONSOLE-1585
Dec 22, 2025
Merged

feat: allow customizing oidc scope per integration#7441
XiNiHa merged 14 commits into
mainfrom
CONSOLE-1585

Conversation

@XiNiHa

@XiNiHa XiNiHa commented Dec 17, 2025

Copy link
Copy Markdown
Contributor

Background

Closes #7355

Description

This PR includes a DB migration that adds a column for storing customized OIDC scope per each integration, and the ability to customize it from the console.

Checklist

  • Input validation
  • Output encoding
  • Authentication management
  • Session management
  • Access control
  • Cryptographic practices
  • Error handling and logging
  • Data protection
  • Communication security
  • System configuration
  • Database security
  • File management
  • Memory management
  • Testing

@gemini-code-assist

gemini-code-assist Bot commented Dec 17, 2025

Copy link
Copy Markdown
Contributor

Summary of Changes

Hello @XiNiHa, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces the capability to define and manage custom OIDC scopes for each integration. This enhancement provides greater flexibility in controlling the specific permissions and information requested during the OpenID Connect authentication flow, allowing administrators to tailor integrations more precisely to their security and data requirements. The changes span the database, API, and user interface to ensure full support for this new feature.

Highlights

  • Database Schema Update: A new database migration introduces a 'scope' column (TEXT array) to the 'oidc_integrations' table, defaulting to ['openid', 'email'], to store custom OIDC scopes.
  • GraphQL API Extension: The GraphQL schema has been updated to include the 'scope' field in OIDC integration types and input objects, allowing for its creation and modification via the API.
  • Backend Logic for Scope Management: The OIDC integrations provider and storage services now handle the 'scope' parameter during the creation and updating of OIDC integrations, including validation.
  • Frontend UI Integration: The web console's OIDC integration settings now feature a dedicated input field for customizing the OIDC scope, complete with client-side JSON validation.
  • SuperTokens Provider Update: The SuperTokens OIDC provider has been modified to dynamically use the configured 'scope' from the OIDC integration settings instead of a hardcoded default.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

@github-actions

github-actions Bot commented Dec 17, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

🚀 Snapshot Release (alpha)

The latest changes of this PR are available as alpha on npm (based on the declared changesets):

Package Version Info
@graphql-hive/apollo 0.46.0-alpha-20251219171725-eecf84c175e53ebf4ea486aa4610baeecca81d9b npm ↗︎ unpkg ↗︎
@graphql-hive/cli 0.57.0-alpha-20251219171725-eecf84c175e53ebf4ea486aa4610baeecca81d9b npm ↗︎ unpkg ↗︎
@graphql-hive/core 0.19.0-alpha-20251219171725-eecf84c175e53ebf4ea486aa4610baeecca81d9b npm ↗︎ unpkg ↗︎
@graphql-hive/envelop 0.40.1-alpha-20251219171725-eecf84c175e53ebf4ea486aa4610baeecca81d9b npm ↗︎ unpkg ↗︎
@graphql-hive/yoga 0.46.1-alpha-20251219171725-eecf84c175e53ebf4ea486aa4610baeecca81d9b npm ↗︎ unpkg ↗︎
hive 8.14.0-alpha-20251219171725-eecf84c175e53ebf4ea486aa4610baeecca81d9b npm ↗︎ unpkg ↗︎
hive-apollo-router-plugin 2.3.6-alpha-20251219171725-eecf84c175e53ebf4ea486aa4610baeecca81d9b npm ↗︎ unpkg ↗︎
hive-console-sdk-rs 0.2.3-alpha-20251219171725-eecf84c175e53ebf4ea486aa4610baeecca81d9b npm ↗︎ unpkg ↗︎

@github-actions

github-actions Bot commented Dec 17, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

📚 Storybook Deployment

The latest changes are available as preview in: https://pr-7441.hive-storybook.pages.dev

gemini-code-assist[bot]
gemini-code-assist Bot reviewed Dec 17, 2025
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces the ability to customize the OIDC scope for each integration. The changes span across the database with a new migration, the backend API to handle the new scope field including validation, and the frontend to allow users to configure it. The implementation is solid. I've added a couple of suggestions to improve error handling in the backend validation and to refactor some duplicated code in the frontend for better maintainability.

Comment thread packages/services/api/src/modules/oidc-integrations/providers/oidc-integrations.provider.ts Outdated
Comment thread packages/web/app/src/components/organization/settings/oidc-integration-section.tsx Outdated
@XiNiHa XiNiHa mentioned this pull request Dec 17, 2025
Closed
@github-actions

github-actions Bot commented Dec 17, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

💻 Website Preview

The latest changes are available as preview in: https://pr-7441.hive-landing-page.pages.dev

@github-actions

github-actions Bot commented Dec 17, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

🐋 This PR was built and pushed to the following Docker images:

Targets: build

Platforms: linux/amd64

Image Tag: eecf84c175e53ebf4ea486aa4610baeecca81d9b

n1ru4l
n1ru4l reviewed Dec 18, 2025
View reviewed changes
Comment thread packages/migrations/src/actions/2025.12.17T00-00-00.oidc-scope.ts Outdated
n1ru4l
n1ru4l reviewed Dec 18, 2025
View reviewed changes
Comment thread packages/migrations/src/actions/2025.12.17T00-00-00.oidc-scope.ts Outdated
@XiNiHa XiNiHa changed the title allow customizing oidc scope per integration feat: allow customizing oidc scope per integration Dec 18, 2025
@XiNiHa XiNiHa force-pushed the CONSOLE-1585 branch 2 times, most recently from 43cdf5b to caa5345 Compare December 18, 2025 15:02
@XiNiHa XiNiHa force-pushed the CONSOLE-1585 branch 2 times, most recently from 06aee44 to 31f48a9 Compare December 18, 2025 15:44
@XiNiHa XiNiHa marked this pull request as ready for review December 19, 2025 15:31
@XiNiHa XiNiHa requested a review from n1ru4l December 19, 2025 15:31
n1ru4l
n1ru4l requested changes Dec 19, 2025
View reviewed changes

@n1ru4l n1ru4l left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added some comments and also accompanying review https://guild-oss.slack.com/archives/C03AQ477ECF/p1766162415309599?thread_ts=1766158269.204989&cid=C03AQ477ECF

Comment thread packages/services/storage/src/index.ts Outdated
Comment thread packages/web/app/src/components/organization/settings/oidc-integration-section.tsx
Comment thread packages/services/api/src/modules/oidc-integrations/providers/oidc-integrations.provider.ts Outdated
@XiNiHa @n1ru4l
allow additional_scopes to be null in DB
0f4c960 
Co-authored-by: Laurin Quast <laurinquast@googlemail.com>
@XiNiHa XiNiHa requested a review from n1ru4l December 19, 2025 17:34
n1ru4l
n1ru4l approved these changes Dec 22, 2025
View reviewed changes

@n1ru4l n1ru4l left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good 👍

@XiNiHa XiNiHa merged commit 0d35406 into main Dec 22, 2025
26 checks passed
@XiNiHa XiNiHa deleted the CONSOLE-1585 branch December 22, 2025 10:57
@theguild-bot theguild-bot mentioned this pull request Dec 22, 2025
Merged
@kroupacz kroupacz mentioned this pull request Jan 7, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@n1ru4l n1ru4l n1ru4l approved these changes
+1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Custom OIDC provider - can't define custom scopes

2 participants

@XiNiHa @n1ru4l