Add no-validate flag to skip scope validation

AzureAD · Mar 4, 2024 · d119446 · d119446
1 parent b6b6453
commit d119446
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 6 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Added
+- `--no-validate` flag to skip scope validation for `ado pat`. This allows addition of non-public ADO scopes.
 
 ## [0.8.4] - 2023-09-05
 ### Changed

diff --git a/src/AzureAuth/Commands/Ado/CommandPat.cs b/src/AzureAuth/Commands/Ado/CommandPat.cs
@@ -36,6 +36,9 @@ public class CommandPat
         private const string ScopeOption = "--scope";
         private const string ScopeHelp = "A token scope for accessing Azure DevOps resources. Repeated invocations allowed.";
 
+        private const string NoValidationFlag = "--no-validate";
+        private const string NoValidationHelp = "Flag to skip scope validation. Allows addition of non-public ADO scopes.";
+
         private const string OutputOption = "--output";
         private const string OutputHelp = "How PAT information is displayed. [default: token]\n[possible values: none, status, token, base64, header, headervalue, json]";
 
@@ -75,6 +78,9 @@ private enum OutputMode
         [Option(ScopeOption, ScopeHelp, CommandOptionType.MultipleValue)]
         private IEnumerable<string> RawScopes { get; set; } = null;
 
+        [Option(NoValidationFlag, NoValidationHelp, CommandOptionType.NoValue)]
+        private bool NoScopeValidation { get; set; }
+
         [Option(OutputOption, OutputHelp, CommandOptionType.SingleValue)]
         private OutputMode Output { get; set; } = OutputMode.Token;
 
@@ -168,15 +174,22 @@ private bool ValidOptions(ILogger logger)
             }
             else
             {
-                var invalidScopes = AdoPat.Scopes.Validate(this.Scopes);
-                if (!invalidScopes.IsEmpty)
+                if(NoScopeValidation)
+                {
+                    logger.LogWarning($"Received {NoValidationFlag} flag. AzureAuth will skip validation of scopes.");
+                }
+                else
                 {
-                    foreach (var scope in invalidScopes)
+                    var invalidScopes = AdoPat.Scopes.Validate(this.Scopes);
+                    if (!invalidScopes.IsEmpty)
                     {
-                        logger.LogError($"{scope} is not a valid Azure DevOps PAT scope.");
+                        foreach (var scope in invalidScopes)
+                        {
+                            logger.LogError($"{scope} is not a valid Azure DevOps PAT scope.");
+                        }
+                        logger.LogError($"Consult {AdoPat.Constants.PatListURL} for a list of valid scopes.");
+                        validOptions = false;
                     }
-                    logger.LogError($"Consult {AdoPat.Constants.PatListURL} for a list of valid scopes.");
-                    validOptions = false;
                 }
             }