pup: remove stale OAuth-excluded endpoints for fleet, cost/billing, and CCM - #762
Merged
platinummonkey merged 7 commits intoAug 27, 2026
Conversation
…nd CCM Remove 32 entries from OAUTH_EXCLUDED_ENDPOINTS for endpoint groups whose server-side routes already accept OAuth: - Fleet Automation (15): v2 routes already have ValidOAuthAccessToken - Cost/Billing (3): server already accepts OAuth (DAL-959) - Cloud Cost Management config (14): server already accepts OAuth (DAL-959) Also remove the brittle OAUTH_EXCLUDED_ENDPOINTS count assertion (test_oauth_excluded_count) which was prone to merge conflicts and tested no actual behavior. Update test_requires_api_key_fallback_fleet to test_no_fallback_for_fleet, and switch the test_other_oauth_excluded_endpoints example from Fleet to Profiling (which remains excluded). Remaining excluded entries (8): DDSQL editor (3, handled by DataDog#756), Profiling (4, no OAuth scope), Events intake (1, SDK codegen issue).
This comment has been minimized.
This comment has been minimized.
Three tests used /api/v2/fleet/agents as their OAuth-excluded example, but fleet entries were removed from OAUTH_EXCLUDED_ENDPOINTS in this PR. Switch all three to use /profiling/api/v1/profiles/abc/info which is still excluded: - test_prefix_matching_with_id (raw_client.rs) - test_api_oauth_excluded_uses_api_keys (api.rs) - test_api_absolute_url_oauth_excluded_uses_api_keys (api.rs)
Add a fake /api/v2/test-oauth-excluded/ entry to OAUTH_EXCLUDED_ENDPOINTS that exists only for tests needing a "still excluded" example. This avoids churn when real endpoints (e.g. profiling) gain OAuth support and are removed from the excluded list. Update test_prefix_matching_with_id, test_other_oauth_excluded_endpoints, test_api_oauth_excluded_uses_api_keys, and test_api_absolute_url_oauth_excluded to use the test fixture instead of profiling or fleet paths. Also fixes the CI failure where api.rs tests used /profiling/ paths that didn't work with run()'s /api/ path prefix prepending.
srosenthal-dd
marked this pull request as ready for review
August 25, 2026 19:49
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a3df23e121
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
platinummonkey
previously approved these changes
Aug 26, 2026
…th-cleanup-excluded # Conflicts: # src/raw_client.rs
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6308c1cb13
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Addresses codex review: no test proved /api/v2/usage/* and /api/v2/cost/* requests use the OAuth bearer instead of falling back to API/application keys, matching the existing fleet coverage.
Addresses codex review: the exclusion table gates real pup api passthrough requests, so a fake path there is live production behavior, not just test fixture. Swap it for the unstable Fleet surface (DAL-509), which is a real, currently-excluded route -- current status, not a permanent contract, and expected to be deleted once DAL-509 ships OAuth support there.
Drop the Jira reference and shorten the explanation.
platinummonkey
approved these changes
Aug 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remove 32 stale entries from
OAUTH_EXCLUDED_ENDPOINTS(src/raw_client.rs) whose server-side routes already accept OAuth: Fleet Automation v2 routes (15, since 2026-06-04), Cost/Billing (3, DAL-959), Cloud Cost Management config (14, DAL-959). This table only affectsraw_get/raw_post(pup apipassthrough and hand-written commands) -- no live pup command usesraw_get/raw_postfor any of these paths today, so this only changespup apipassthrough behavior.Note: this doesn't close pup's fleet OAuth gap.
fleet.rs's commands call/api/unstable/fleet/*, not the/api/v2/fleet/*paths covered here, and that surface still deliberately excludes OAuth (DAL-509, separate issue).Also removes the brittle
test_oauth_excluded_countassertion.Remaining excluded entries (8)