Skip to content

feat: add --client to user assign-role/remove-role - #39

Merged
NathaelB merged 2 commits into
mainfrom
feat/user-role-client-scope
Sep 3, 2026
Merged

feat: add --client to user assign-role/remove-role#39
NathaelB merged 2 commits into
mainfrom
feat/user-role-client-scope

Conversation

@NathaelB

@NathaelB NathaelB commented Sep 3, 2026

Copy link
Copy Markdown
Member

Summary

--client <client_id> on user assign-role and user remove-role — resolves the named role among that client's roles instead of realm roles, mirroring realm role's existing --client support (#30/#33).

Issue

Closes #23 — this was the one piece left over from #29/#31, previously deferred because I didn't want to guess a doubly-nested assignment endpoint. Turns out none is needed: verified live in #37 that assign_user_role/remove_user_role accept a client role id through the exact same endpoint as a realm role id (role ids are unique across both scopes — same finding as delete_role in #33). So this PR is just wiring --client through to role resolution; the assignment calls themselves are unchanged.

Stacked on #38#37#36#35

Same chain as the last few: branched from feat/client-secret-command (#38). Merge in order: #35, #36, #37, #38, then this one.

Verification

Ran live against a local FerrisKey server: created a client with a client-scoped role and a throwaway user, ran assign-role --client, confirmed via user roles, ran remove-role --client, confirmed it's gone. Cleaned up all fixtures.

Test plan

  • cargo build --workspace
  • cargo test --workspace (80 passed)
  • cargo clippy --workspace --all-targets --all-features -- -D warnings
  • Manual assign/remove of a client role against a running FerrisKey server (see above)

@NathaelB NathaelB self-assigned this Sep 3, 2026
@coderabbitai

coderabbitai Bot commented Sep 3, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: a07739e2-13f8-404e-b56e-e3d809e0c3bd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@NathaelB
NathaelB force-pushed the feat/client-secret-command branch from 4d62ad2 to 49069f3 Compare September 3, 2026 00:30
@NathaelB
NathaelB force-pushed the feat/user-role-client-scope branch from 298595a to e48c2c7 Compare September 3, 2026 00:31
Add `ferris-ctl client secret <client_id> [--realm <realm>]`, reading
a confidential client's secret via GET .../clients/{uuid}/client-secret
(the endpoint cited in the issue, confirmed to exist server-side).
Prints the raw secret to stdout only, so it can be piped/captured; all
other output stays on stderr, ignoring --output deliberately.

realm import now also reads and reports the secret of every
confidential client it touches, so an import is self-sufficient
without a follow-up `client secret` call per client.

The endpoint's response shape isn't documented; ClientSecretPayload
accepts the plausible variants (bare string, {secret}, and either
enveloped in {data: ...}) rather than assuming one — see PR
description for what could and couldn't be verified live.
@NathaelB
NathaelB force-pushed the feat/client-secret-command branch from 49069f3 to f5e27a2 Compare September 3, 2026 00:49
Closes the last gap in #23: a role assigned to or removed from a user
could only be a realm role. --client resolves the role among that
client's roles instead, mirroring realm role's --client support.

assign_user_role/remove_user_role need no client-scoped variant: role
ids are unique across realm and client scopes, so the existing
endpoints accept a client role id directly (verified live) — same
finding as delete_role in #33.
@NathaelB
NathaelB force-pushed the feat/user-role-client-scope branch from e48c2c7 to 025c036 Compare September 3, 2026 00:49
Base automatically changed from feat/client-secret-command to main September 3, 2026 00:53
@NathaelB
NathaelB merged commit 3b30f56 into main Sep 3, 2026
1 check passed
@NathaelB
NathaelB deleted the feat/user-role-client-scope branch September 3, 2026 00:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

user cannot assign roles or set a password

1 participant