@kaavee315checks…codex/fix-oauth-scope-over-grant-vulnerability → master3 files · +19 −33review: @rohanprabhureview: @sarthakreview: @acsrujanreview: @anshugarg15updated 1w agotools_for_connected_account_creation by restoring least-privilege selection for structured scope requirements.any_of alternative into the created authConfig, which caused broader OAuth permissions to be requested and stored.selectScopesForAuth to pick a single alternative per any_of clause, reusing an already-selected scope when possible, instead of unioning every any_of option (file: src/lib/tools/scope_requirements.ts).src/lib/tools/scope_requirements.test.ts).selected_scopes_required as the selected tool-derived scopes rather than a full union (file: src/lib/auth_config/utils/getParsedScopes.test.ts).oxfmt passed for the modified files (apps/apollo/src/lib/tools/scope_requirements.ts, apps/apollo/src/lib/tools/scope_requirements.test.ts, apps/apollo/src/lib/auth_config/utils/getParsedScopes.test.ts).oxlint passed on the modified files.vitest but full runs were blocked by environment/build prerequisites: missing Doppler secrets and a generated Prisma client, and a CI prisma generate attempt failed due to Prisma engine download errors; as a result vitest runs could not complete successfully in this environment.Based on git blame analysis of 3 file(s):
| Contributor | Contribution | Files |
|---|---|---|
| jkomyno | 46% | 2 |
| lingalarahul7 | 37% | 1 |
| Zen | 17% | 3 |
Based on git history, jkomyno or lingalarahul7 would be good reviewer(s) for this PR.
🤖 Based on git blame with recency weighting (recent edits count more).