oh so queerious

[ImShyMike]

No description provided.

[greptile-apps]

Greptile Summary

This revision completes endpoint-specific OAuth scope enforcement and makes development OAuth seeding deterministic.

• Requires profile for user details, read for aggregate statistics, and heartbeats for raw heartbeat data.
• Adds valid-token/missing-scope request coverage for every scoped endpoint.
• Updates the fixed-UID desktop application and exact development token in place, avoiding unrelated application and token mutation.
• Enables refresh tokens, shortens access-token lifetime to six months, and updates OAuth documentation and Swagger output.
• Removes the OAuth endpoint that exposed or created a user’s API key.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the prior scope-test and seed idempotency issues are addressed by explicit missing-scope cases, fixed-UID application lookup, exact development-token lookup, and unconditional scope reassignment.

Important Files Changed

Filename	Overview
app/controllers/api/v1/authenticated/application_controller.rb	Centralizes Doorkeeper authorization around endpoint-provided scope requirements.
app/controllers/api/v1/authenticated/heartbeats_controller.rb	Protects raw latest-heartbeat data with the dedicated heartbeats scope.
config/initializers/doorkeeper.rb	Registers the heartbeat scope, changes access-token expiry to six months, and enables refresh tokens.
db/seeds.rb	Updates the desktop OAuth application by fixed UID and the development access token by exact token value with all required scopes.
spec/requests/api/v1/authenticated_spec.rb	Adds valid-token/insufficient-scope coverage for every newly scoped endpoint.
config/routes.rb	Removes the authenticated endpoint that returned or created a user API key.
docs/oauth/oauth-apps.md	Documents scope separation, shorter token expiry, refresh-token rotation, and removal of the API-key endpoint.
swagger/v1/swagger.yaml	Synchronizes generated API documentation with scoped 403 responses and route removal.

Sequence Diagram

sequenceDiagram
  participant Client as OAuth Client
  participant API as Authenticated API
  participant DK as Doorkeeper
  participant User as User Data
  Client->>API: Bearer access token
  API->>DK: authorize required endpoint scope
  alt Token invalid or expired
    DK-->>Client: 401 Unauthorized
  else Required scope missing
    DK-->>Client: 403 Forbidden
  else Scope granted
    DK-->>API: Authorized resource owner
    API->>User: Read permitted data
    User-->>Client: 200 JSON response
  end

Loading

_{Reviews (6): Last reviewed commit: "Fix seeding! (i am going insane)" | Re-trigger Greptile}