Function main

scripts/check-scopes/main.go:23–59

()

var dumpPathFlag = flag.String("dump", defaultDumpPath, "path to dump.sql (defaults to coderd/database/dump.sql)")

func main() {
	flag.Parse()

	want := expectedFromRBAC()
	have, err := enumValuesFromDump(*dumpPathFlag)
	if err != nil {
		_, _ = fmt.Fprintf(os.Stderr, "check-scopes: error reading dump: %v\n", err)
		os.Exit(2)
	}

	// Compute missing: want - have
	var missing []string
	for k := range want {
		if _, ok := have[k]; !ok {
			missing = append(missing, k)
		}
	}
	slices.Sort(missing)

	if len(missing) == 0 {
		_, _ = fmt.Println("check-scopes: OK — all RBAC <resource>:<action> values exist in api_key_scope enum")
		return
	}

	_, _ = fmt.Fprintln(os.Stderr, "check-scopes: missing enum values:")
	for _, m := range missing {
		_, _ = fmt.Fprintf(os.Stderr, "  - %s\n", m)
	}
	_, _ = fmt.Fprintln(os.Stderr)
	_, _ = fmt.Fprintln(os.Stderr, "To fix: add a DB migration extending the enum, e.g.:")
	for _, m := range missing {
		_, _ = fmt.Fprintf(os.Stderr, "  ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS '%s';\n", m)
	}
	_, _ = fmt.Fprintln(os.Stderr)
	_, _ = fmt.Fprintln(os.Stderr, "Also decide if each new scope is external (exposed in the `externalLowLevel` in coderd/rbac/scopes_catalog.go) or internal-only.")
	os.Exit(1)
}

// expectedFromRBAC returns the set of scope names the DB enum must support.
func expectedFromRBAC() map[string]struct{} {