tweaked args descriptions, added default value for WATCHER_SCOPE_PREFIX

NUWCDIVNPT · Mar 27, 2024 · df9bb0d · df9bb0d
1 parent 5b4b4a9
commit df9bb0d
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/lib/args.js b/lib/args.js
@@ -88,8 +88,8 @@ program
 .requiredOption('--api <url>', 'Base URL of the STIG Manager API service (`WATCHER_API_BASE`).', pe.WATCHER_API_BASE)
 .requiredOption('--authority <url>', 'Base URL of the OIDC authentication service that issues OAuth2 tokens for the API (`WATCHER_AUTHORITY`)', pe.WATCHER_AUTHORITY)
 .requiredOption('--client-id <string>', 'OIDC clientId to authenticate (`WATCHER_CLIENT_ID`). You will be prompted for the client secret if `--client-key` is not present and `--prompt` is present, unless `WATCHER_CLIENT_SECRET` is set', pe.WATCHER_CLIENT_ID)
-.option('--scope-prefix <string>', 'String used as a prefix for each scope when authenticating to the OIDC Provider.',  pe.WATCHER_SCOPE_PREFIX)
-.option('--extra-scopes <string>', 'OAuth2 scopes to request in addition to the default scopes.',  pe.WATCHER_EXTRA_SCOPES)
+.option('--scope-prefix <string>', 'String used as a prefix for default stig-manager scopes (except `openid`) when authenticating to the OIDC Provider.',  pe.WATCHER_SCOPE_PREFIX ?? '')
+.option('--extra-scopes <string>', 'Space separated OAuth2 scopes to request in addition to the default scopes. Will not be automatically prefixed with WATCHER_SCOPE_PREFIX value.',  pe.WATCHER_EXTRA_SCOPES)
 .option('--client-key <path>', 'Path to a PEM encoded private key (`WATCHER_CLIENT_KEY`). If the key is encrypted, you will be prompted for the passphrase if `--prompt` is present, unless `WATCHER_CLIENT_KEY_PASSPHRASE` is set.',  pe.WATCHER_CLIENT_KEY)
 .option('--add-existing', 'For `--mode events`, existing files in the path will generate an `add` event (`WATCHER_ADD_EXISTING=1`). Ignored if `--mode scan`, negate with `--no-add-existing`.',  getBoolean('WATCHER_ADD_EXISTING', false))
 .option('--no-add-existing', 'Ignore existing files in the watched path (`WATCHER_ADD_EXISTING=0`).')

diff --git a/lib/auth.js b/lib/auth.js
@@ -105,11 +105,11 @@ async function getToken () {
 async function authenticateClientSecret () {
   const parameters = {
     form: {
-      grant_type: 'client_credentials'
+      grant_type: 'client_credentials',
+      scope: self.scope
     },
     username: options.clientId,
     password: options.clientSecret,
-    scope: self.scope,
     responseType: 'json'
   }