Org Web Adapter

Editing pages/mmpy_280_create_staff_user_oauth_scope_for_hold_process.org

:PROPERTIES:
:ID:       0eb77825-0402-474a-a729-621d83497461
:END:
#+title: MMPY-280 Create staff-user oauth scope for hold process

- source :: https://multimediallc.atlassian.net/browse/MMPY-280
- epic :: [[id:88adb9ec-ab52-4d87-8625-6cf72d01612c][MMPY-198 Compliance Holds, Fraud Holds, and Banned Payees]]
- tags ::  [[id:4b532967-a1d9-45f4-b1f0-9a02ad540ff0][Falcon Nest Project Story]] [[id:7c3bbb4e-d079-42c4-992c-3e76210911f4][Falcon Nest Project]]
- status ::  [[id:4d41d978-e56f-45c1-88d1-e2c76510972e][Status - Complete]]

* Description
In the creation and removal of holds from Chaturbate, we want to record the user
who performed the action. Implement an auth flow that explicitly sets the user.

* Requirements
** GIVEN

A CB staff user

** WHEN

The CB user wants to add or remove a compliance hold (via another action they
have taken)

** THEN

Provide a staff-user scoped token for that user and record the user who took the
add or removal action for the hold from the user in the token.

* Tasks
** DONE Add source_application_admin_username to API request body :work:multimediallc:mmpy280:mmpy198:holds:authz:feature:
:PROPERTIES:
:ID:       6087233e-0c62-7060-835e-b0bb9c6ddb1f
:END:
<2025-08-15 Fri>
** DONE Add tests for new required API body parameter source_application_admin_username request body :tests:work:multimediallc:mmpy280:mmpy198:holds:authz:feature:
:PROPERTIES:
:ID:       c4faa4f4-382e-c3b6-7594-4d66cbc57ea5
:END:
<2025-08-15 Fri>
* Comments
- Note taken on [2025-08-14 Fri 13:38]

In standup today, @AaronIreland offered his opinion that this can be done two ways:

Inside the OAuth flow as a claim, similar to the is_banned claim

As a required parameter in the request body of API calls for certain source admin user endpoints

After talking it over, I think #2 is our preferred solution for right now. #1 is very robust and probably the “right way,” but it also would be more useful if we had lots of fine-grained authz to do against a source application admin user. In this case, all we want is an audit trail in Nest regarding who took a specific action from a given source application. Thus, requiring the CB app to send an associated user ID in the request should more than suffice for now.