Nice fix for the scopes and allow list. One remaining gap is that a newly created key can still outlive the key that created it.

The lifetime is capped by the deployment max, but not by the caller’s expiry. For example, a key with 1 hour remaining and api_key:create could create a token that lasts much longer. It looks like postAPIKey has the same issue.

Since this is part of the “longer-lived” issue from the security report, I’d recommend fixing it in this PR, perhaps by capping ExpiresAt to the caller’s expiry in CapToCaller. If you’d prefer to address it separately, I’m also okay with a follow-up PR/issue.

This PR makes postToken, postAPIKey, auth-redirect, and /oauth2/authorize refuse or inherit instead of minting beyond the caller's scopes and allow list. Findings: 1 P2, 6 P3, 6 P4, 2 Nit.

The P2 is the lifetime gap @BobbyHo raised: a child key is not bounded by the caller's expiry.

Out of scope (needs a ticket or explicit acceptance by a human):

• coderd/provisionerdserver/provisionerdserver.go:3171: each workspace start mints a coder:all, *:* key for the owner whatever scope the starting credential had, so a scoped token that can start a workspace and read the agent environment obtains an unscoped key. The PR description lists this without a ticket.
• coderd/oauth2provider/authorize.go:834: ProcessAuthorize answers a failed InsertOAuth2ProviderAppCode (an authorization denial for a scoped session) with 500 server_error, so the user sees a server fault after clicking Allow.
• coderd/apikey.go:133: rbac.NewAllowListElement keeps the client's UUID case while ParseAllowListEntry lowercases, so an uppercase workspace:<UUID> entry never matches in policy.rego and now also gets a 403 naming an entry the caller holds.
• coderd/apikey.go:366: keys minted by POST /users/{user}/keys are LoginTypePassword, so GET /users/{user}/keys/tokens never lists them and the user cannot see or revoke them from the token page.

Notes:

• +coderd/oauth2provider/authorize.go:694: a scoped session whose scopes cover the grant passes withinSession, then POST returns 500 because no scoped token can hold oauth2_app_code_token:create. No scoped session can complete /oauth2/authorize, and TestOAuth2AuthorizeSessionCeiling has no success case for one.
• coderd/rbac/allowlist.go:232: FirstAllowListEntryNotCovered admits the same entries as object_is_included_in_scope_allow_list in policy.rego, including *:<id>, so checking scopes and allow list separately bounds the child's authority.

docs/admin/integrations/oauth2-provider/troubleshooting.md:36

P3 [CRF-7] This list of invalid_scope descriptions does not include the one this PR adds, and the new one does not open with the requested name as line 36 promises. (Leorio, Zoro)

It is the only rejection a user fixes by signing in with a different credential rather than changing the request or the app's allowlist, and an integrator searching this page for it finds nothing. Add an entry (two, if the allow-list case gets its own description): the signed-in session must hold every requested scope and an allow list of *:*, which every browser login has.

🤖

coderd/oauth2provider/authorize.go:32

P4 [CRF-13] "Rejection reasons from scope negotiation." no longer covers errBeyondSession, which only withinSession returns. (Gon)

Change the header to include the session check, or declare errBeyondSession next to withinSession.

🤖

🤖 This review was automatically generated with Coder Agents.

LGTM. Thanks for addressing the comments in the PR.