feat: restore notification scopes; raise MAX_SCOPES to 78 - #143
Merged
Conversation
Re-adds notification:read + notification:write to ALL_SCOPES, REGISTERED_SCOPES, and the consent-UI maps. They were removed in #139 on the incorrect assumption that logs.* covered notifications — on the live bach branch nothing else the client retains carries account.notification perms, so the removal was a real capability loss. This pushes the yolo (full-access) template to 78 scopes. Verified on staging (staging.mcp.cloudflare.com) that the OAuth grant + live API calls succeed with the full 78-scope template — so the previous MAX_SCOPES=76 ceiling was conservative. Raised MAX_SCOPES to 78 to match the validated server behavior. - scopes.ts: ALL_SCOPES 78→80; yolo 76→78; MAX_SCOPES 76→78 - scopes.test.ts: REGISTERED_SCOPES += notification:read/write - workers-oauth-utils.ts: consent-UI notification (Networking) All 188 tests pass; staging deploy verified.
mattzcarey
force-pushed
the
feat/restore-notification-scopes
branch
from
June 3, 2026 19:55
5d948fc to
eeca0e4
Compare
mattzcarey
marked this pull request as ready for review
June 3, 2026 19:55
danielbodnar
pushed a commit
to danielbodnar/mcp
that referenced
this pull request
Jun 10, 2026
* feat: add OAuth protected resource metadata (RFC 9728) Add resourceMetadata config to OAuthProvider for the /.well-known/oauth-protected-resource endpoint. Bump workers-oauth-provider to PR cloudflare#136 build which implements the endpoint. * chore: upgrade workers-oauth-provider to PR 143 preview Includes both RFC 9728 changes: - /.well-known/oauth-protected-resource endpoint (cloudflare#136) - resource_metadata in WWW-Authenticate headers (cloudflare#143) * chore: bump workers-oauth-provider to v0.2.4 (released) Replace pkg.pr.new preview build with the released v0.2.4 which includes RFC 9728 support (cloudflare#136, cloudflare#143), RFC 8252 loopback port flexibility for native apps (cloudflare#145), and other fixes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Restores
notification:read+notification:write(removed in #139) and raisesMAX_SCOPESfrom 76 to 78.Why restore notifications
#139 removed them on the assumption that
logs.read/logs.writecovered notifications. On the live bach branch they do not — no scope the client retains carriescom.cloudflare.api.account.notification.*perms. So the removal was a real capability loss (users could no longer manage notification policies via MCP). This restores them.Why raise MAX_SCOPES to 78
Restoring both notification scopes pushes the
yolo(full-access) template to 78. The oldMAX_SCOPES=76was a conservative guess at the server-side limit.Validated on staging: deployed this build to
staging.mcp.cloudflare.comand confirmed the OAuth grant and live API calls (GET /zones) succeed with the full 78-scope template — no "Something went wrong!". So 78 is accepted server-side. Raised the constant to match reality.Changes
scopes.ts—ALL_SCOPES78→80;yolo76→78;MAX_SCOPES76→78 (+ comment updated)scopes.test.ts—REGISTERED_SCOPES+= notification:read/writeworkers-oauth-utils.ts— consent-UInotificationresource (Networking)Verification
Dependency
Terraform MR !120 (cloudflare/iam) already restores
notification:read/notification:writeon the OAuth client registration, so the scopes are grantable.