Repository navigation
Conversation
…gos login`
Every `/accounts/{accountSlug}/...` endpoint requires the `account:admin`
OAuth scope, which `argos login` never requested, so `argos account *`
answered 403 with a hint (log in again) that could not help.
The consent screen already offers an "Admin" access level to the CLI,
because `projects:write` is an admin scope, and describes it as managing
organizations. `account:admin` now joins it there; the default access
level stays "Read and write".
The scope hint now names the missing scope and its fix: choose "Admin"
access for an admin scope, log in again for any other, or use a personal
access token for a scope `argos login` never requests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Argos API protects every
/accounts/{accountSlug}/...endpoint withpatOrOAuthAuth(["account:admin"]). That covers account get and update, members, invites, domains, and the project tokens from argos-ci/argos#2747.argos loginnever requestedaccount:admin, so with anargos loginsession everyargos account *command failed with403 Insufficient scope. The hint then said "runargos loginagain", which could never fix it. Theargos-cliskill also saidaccount *works withargos login.Fix
account:adminis added toOAUTH_SCOPES(option 1 from the issue). On the backend consent page (apps/frontend/src/util/oauth-consent.tsin argos-ci/argos):projects:writeis alreadylevel: "admin", so the CLI already gets an "Admin" preset. Its description reads "Also create and configure projects, and manage organizations", which was untrue for the CLI until now.account:adminis alsolevel: "admin", so it joins that same preset. There is no new preset, and the default stays "Read and write" ("Administration is opted into").The scope hint now names the missing scope (taken from the API's
This endpoint requires: …message) and gives the fix that works. A session can now be missing a scope even after a fresh login, because the user can keep the default access level. So the hint has three cases:projects:write,account:admin): runargos loginagain and choose "Admin" accessargos loginagainText that doesn't look like a scope is never echoed back.
Skill:
skills/argos-cli/SKILL.mdnow says which commands need "Admin" access withargos login, and what to do onInsufficient scope.Tests
run.test.ts: one test per hint case, a mixed admin and non-admin requirement, an unparseable message, and an injected escape sequence.oauth.test.ts: the authorize URL requestsaccount:admin.pnpm -F @argos-ci/cli test(158 passed),tsc, eslint and prettier all pass.Users who are already logged in must run
argos loginagain and choose "Admin" before they can useaccountcommands. The new hint tells them to.🤖 Generated with Claude Code