fix: request llm_gateway:read scope during signup provisioning#435
Open
fix: request llm_gateway:read scope during signup provisioning#435
Conversation
The wizard's --signup path was minting OAuth tokens with no scopes, so the agent step's call to gateway.us.posthog.com/wizard returned 401 "Authentication required" and the wizard exited before writing the SDK integration into the project. Extract the wizard's required scopes into shared constants and pass them to /api/agentic/provisioning/account_requests. The provisioning subset intentionally excludes introspection and health_issue:read since those are not in ALLOWED_PROVISIONING_SCOPES on the backend.
🧙 Wizard CIRun the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands: Test all apps:
Test all apps in a directory:
Test an individual app:
Show more apps
Results will be posted here when complete. |
Address self-review feedback: - Document why each scope in WIZARD_PROVISIONING_SCOPES is needed (the agent step's actual usage), pre-empting least-privilege questions on dashboard:write and insight:write. - Switch the provisioning test from arrayContaining to exact-array equality so adding/removing a scope without updating the test fails loudly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The wizard's
--signupflow exits with a 401 ("Authentication failed") immediately after provisioning succeeds, so nothing is ever written into the user's project. Repro:/tmp/posthog-wizard.logshows the chain:Account + project + PAT are all created server-side, but the agent step that writes the SDK integration immediately bails on the first call to
gateway.us.posthog.com/wizard.Root cause:
provisionNewAccountinsrc/utils/provisioning.tsPOSTs to/api/agentic/provisioning/account_requestswith noscopesfield. The PostHog backend (ee/api/agentic_provisioning/views.py:315) defaults to[],_validate_scopesshort-circuits empty lists as valid, and the issued OAuth token gets minted with zero scopes. The LLM gateway requiresllm_gateway:read, so the agent's first request 401s.The non-signup OAuth path in
setup-utils.ts:491already requests the right scopes (includingllm_gateway:read); the signup path was just never updated to match.Changes
src/lib/constants.ts:WIZARD_PROVISIONING_SCOPES— the 6 scopes the wizard needs that are also in the backend'sALLOWED_PROVISIONING_SCOPESallowlist.WIZARD_OAUTH_SCOPES— superset that addsintrospectionandhealth_issue:read, which only apply to the OAuth login path (not in the provisioning allowlist).scopes: WIZARD_PROVISIONING_SCOPESin theaccount_requestsbody inprovisionNewAccount.setup-utils.tswith the new constant so the two paths can't drift again.The provisioning subset deliberately excludes
introspectionandhealth_issue:readbecause they are not inALLOWED_PROVISIONING_SCOPES(posthog/posthog ee/api/agentic_provisioning/views.py:2033-2052). If the wizard ever needs them on the signup path, they need to be added to that allowlist first.Test plan
provisionNewAccounttests still pass (pnpm exec jest src/utils/__tests__/provisioning.test.ts)scopesincludesllm_gateway:read,project:read,user:readpnpm typecheckpnpm lint(no new errors; existing warnings only)npx @posthog/wizard --signup --email <fresh>@gmail.com --region usagainst a built copy of this branch and confirm the agent step proceeds past auth and writes the SDK integration into the project. (Will verify after merge or via local link.)