feat: add --client to user assign-role/remove-role - #39
Merged
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
NathaelB
force-pushed
the
feat/client-secret-command
branch
from
September 3, 2026 00:30
4d62ad2 to
49069f3
Compare
NathaelB
force-pushed
the
feat/user-role-client-scope
branch
from
September 3, 2026 00:31
298595a to
e48c2c7
Compare
Add `ferris-ctl client secret <client_id> [--realm <realm>]`, reading
a confidential client's secret via GET .../clients/{uuid}/client-secret
(the endpoint cited in the issue, confirmed to exist server-side).
Prints the raw secret to stdout only, so it can be piped/captured; all
other output stays on stderr, ignoring --output deliberately.
realm import now also reads and reports the secret of every
confidential client it touches, so an import is self-sufficient
without a follow-up `client secret` call per client.
The endpoint's response shape isn't documented; ClientSecretPayload
accepts the plausible variants (bare string, {secret}, and either
enveloped in {data: ...}) rather than assuming one — see PR
description for what could and couldn't be verified live.
NathaelB
force-pushed
the
feat/client-secret-command
branch
from
September 3, 2026 00:49
49069f3 to
f5e27a2
Compare
Closes the last gap in #23: a role assigned to or removed from a user could only be a realm role. --client resolves the role among that client's roles instead, mirroring realm role's --client support. assign_user_role/remove_user_role need no client-scoped variant: role ids are unique across realm and client scopes, so the existing endpoints accept a client role id directly (verified live) — same finding as delete_role in #33.
NathaelB
force-pushed
the
feat/user-role-client-scope
branch
from
September 3, 2026 00:49
e48c2c7 to
025c036
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--client <client_id>onuser assign-roleanduser remove-role— resolves the named role among that client's roles instead of realm roles, mirroringrealm role's existing--clientsupport (#30/#33).Issue
Closes #23 — this was the one piece left over from #29/#31, previously deferred because I didn't want to guess a doubly-nested assignment endpoint. Turns out none is needed: verified live in #37 that
assign_user_role/remove_user_roleaccept a client role id through the exact same endpoint as a realm role id (role ids are unique across both scopes — same finding asdelete_rolein #33). So this PR is just wiring--clientthrough to role resolution; the assignment calls themselves are unchanged.Stacked on #38 → #37 → #36 → #35
Same chain as the last few: branched from
feat/client-secret-command(#38). Merge in order: #35, #36, #37, #38, then this one.Verification
Ran live against a local FerrisKey server: created a client with a client-scoped role and a throwaway user, ran
assign-role --client, confirmed viauser roles, ranremove-role --client, confirmed it's gone. Cleaned up all fixtures.Test plan
cargo build --workspacecargo test --workspace(80 passed)cargo clippy --workspace --all-targets --all-features -- -D warnings