From 9c0682b986248af435cc41f3e494bb3026fa89a1 Mon Sep 17 00:00:00 2001 From: Bharat Kathi Date: Wed, 9 Sep 2026 12:53:20 -0700 Subject: [PATCH] fix(auth): remove Sentinel scope bypass --- depot/api/api.go | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/depot/api/api.go b/depot/api/api.go index 74768f4..84f8f75 100644 --- a/depot/api/api.go +++ b/depot/api/api.go @@ -171,15 +171,6 @@ func RequestTokenExists(c *gin.Context) bool { return exists } -func RequestTokenHasScope(c *gin.Context, scope string) bool { - for _, tokenScope := range strings.Fields(GetRequestTokenScopes(c)) { - if tokenScope == scope { - return true - } - } - return false -} - func RequestTokenHasGroupName(c *gin.Context, groupName string) bool { for _, tokenGroup := range GetRequestTokenGroupNames(c) { if tokenGroup == groupName { @@ -209,14 +200,10 @@ const AdminGroupName = "DepotAdmins" // the token must have been minted for Depot's own OAuth client, and its entity // must belong to the DepotAdmins group. An application token can never // reshape Depot regardless of what its entity's group memberships say. -// sentinel:all remains as first-party break-glass for Sentinel's own tooling. func RequestTokenIsAdmin(c *gin.Context) bool { if !RequestTokenExists(c) { return false } - if RequestTokenHasScope(c, "sentinel:all") { - return true - } return RequestTokenIsFirstParty(c) && RequestTokenHasGroupName(c, AdminGroupName) }