feat: OAuth scopes for orgs and teams

[supalarry]

Fixes #27893

[linear]

CAL-7201 feat: OAuth scopes for orgs and teams

[cubic-dev-ai]

2 issues found across 3 files (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/v2/src/modules/auth/guards/oauth-permissions/oauth-permissions.guard.e2e-spec.ts">

<violation number="1" location="apps/api/v2/src/modules/auth/guards/oauth-permissions/oauth-permissions.guard.e2e-spec.ts:235">
P3: This helper duplicates the existing getAccessToken logic; consider generalizing the existing helper to accept an optional userId or reuse it instead of reimplementing the OAuth token exchange flow.</violation>
</file>

<file name="apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts">

<violation number="1" location="apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts:30">
P1: Security: Bypassing RolesGuard for third-party tokens conflates OAuth *scope* authorization with *role/membership* authorization. OAuthPermissionsGuard only checks that the token has the right scopes — it does not verify the user's role within a specific org/team. This means a third-party token with e.g. `ORG_PROFILE_READ` scope could access endpoints requiring `ORG_ADMIN` role, because the role check is skipped entirely. Scopes and roles are orthogonal authorization layers and should both be enforced.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[github-actions]

Devin AI is addressing Cubic AI's review feedback

A Devin session has been created to address the issues identified by Cubic AI.

View Devin Session

[devin-ai-integration]

I reviewed both Cubic AI comments and checked their confidence scores:

1. P1 Security — roles.guard.ts:30 (RolesGuard bypass for third-party tokens): Confidence 8/10 — below the 9/10 threshold.
2. P3 — oauth-permissions.guard.e2e-spec.ts:235 (duplicate getAccessToken helper): Confidence 7/10 — below the 9/10 threshold.

Per the review policy, only issues with confidence ≥ 9/10 are auto-fixed. Neither issue meets that bar, so no changes were made in this pass. The PR author should evaluate both findings manually — particularly the P1 security concern about orthogonal scope vs. role authorization.

Link to Devin run