Task: Implement a dynamic list of allowed scopes when issuing tokens

[kairoaraujo]

What is the task about?

This task generates a dynamic list of allowed scopes when issuing tokens.

This is a static list that excludes write:token as can see here:

repository-service-tuf-api/repository_service_tuf_api/token.py

Lines 86 to 94 in 7597519

	scopes: List[
	Literal[
	SCOPES_NAMES.read_bootstrap.value,
	SCOPES_NAMES.read_settings.value,
	SCOPES_NAMES.read_tasks.value,
	SCOPES_NAMES.read_token.value,
	SCOPES_NAMES.write_targets.value,
	SCOPES_NAMES.delete_targets.value,
	]

This list can be originated from

repository-service-tuf-api/repository_service_tuf_api/token.py

Line 86 in 7597519

scopes: List[

or

repository-service-tuf-api/repository_service_tuf_api/__init__.py

Lines 54 to 66 in 7597519

	SCOPES = {
	SCOPES_NAMES.read_bootstrap.value: "Read (GET) bootstrap",
	SCOPES_NAMES.read_settings.value: "Read (GET) settings",
	SCOPES_NAMES.read_tasks.value: "Read (GET) tasks",
	SCOPES_NAMES.read_token.value: "Read (GET) tokens",
	SCOPES_NAMES.read_metadata.value: "Read (GET) metadata",
	SCOPES_NAMES.write_targets.value: "Write (POST) targets",
	SCOPES_NAMES.write_token.value: "Write (POST) token",
	SCOPES_NAMES.write_bootstrap.value: "Write (POST) bootstrap",
	SCOPES_NAMES.write_settings.value: "Write (PUT) settings",
	SCOPES_NAMES.write_metadata.value: "Write (POST) metadata",
	SCOPES_NAMES.delete_targets.value: "Delete (DELETE) targets",
	}

Note:

It must exclude write:token
Currently the write:bootstrap is not allowed also as scope in token, it is good to discuss it in this issue.

repository-service-tuf-api/tests/bdd/features/tokens/generate.feature

Lines 41 to 56 in 7597519

	Scenario Outline: Admin cannot generate Token using HTTP API for certain scopes
	Given the admin has the admin password
	And the admin gets an 'access_token' by logging in to '/api/v1/token' with a 'write:token' scope
	And the admin adds Authorization Bearer 'access_token' in the 'headers'
	And the admin adds JSON payload with scopes: <scopes> and expires: <expires>
	When the admin sends a POST request to '/api/v1/token/new' with not allowed 'scopes' in 'payload'
	Then the admin should get status code '422'
	Examples:
	| scopes | expires |
	| ['write:token'] | 24 |
	| ['read:bootstrap','write:token'] | 24 |
	| ['write:bootstrap'] | 24 |
	| ['write:bootstrap', 'read:settings'] | 24 |
	| [] | 24 |
	| [''] | 24 |

Parent feature

• Bug: API does not support "read:metadata", "write:metadata" #408

References

No response

Code of Conduct

• I agree to follow this project's Code of Conduct