feat: OAuth scopes for orgs and teams

[supalarry]

Fixes #27893

[linear]

CAL-7201 feat: OAuth scopes for orgs and teams

[cubic-dev-ai]

2 issues found across 3 files (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/v2/src/modules/auth/guards/oauth-permissions/oauth-permissions.guard.e2e-spec.ts">

<violation number="1" location="apps/api/v2/src/modules/auth/guards/oauth-permissions/oauth-permissions.guard.e2e-spec.ts:235">
P3: This helper duplicates the existing getAccessToken logic; consider generalizing the existing helper to accept an optional userId or reuse it instead of reimplementing the OAuth token exchange flow.</violation>
</file>

<file name="apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts">

<violation number="1" location="apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts:30">
P1: Security: Bypassing RolesGuard for third-party tokens conflates OAuth *scope* authorization with *role/membership* authorization. OAuthPermissionsGuard only checks that the token has the right scopes — it does not verify the user's role within a specific org/team. This means a third-party token with e.g. `ORG_PROFILE_READ` scope could access endpoints requiring `ORG_ADMIN` role, because the role check is skipped entirely. Scopes and roles are orthogonal authorization layers and should both be enforced.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[github-actions]

Devin AI is addressing Cubic AI's review feedback

A Devin session has been created to address the issues identified by Cubic AI.

View Devin Session

[supalarry]

Implemented feedback from Carina:

1. When developer creates an OAuth client we now group possible scopes under "user", "team" and "organization". Notably, all of them by default are now deselected.

BEFORE:

AFTER:

2. In the authorization screen we display all scopes if only, for example, user scopes are requested

if they also include team and organization scopes then we group them

3. When admins review OAuth clients warn them if they contain team or org scopes