ID

0eb77825-0402-474a-a729-621d83497461

MMPY-280 Create staff-user oauth scope for hold process

- source :: https://multimediallc.atlassian.net/browse/MMPY-280

- epic :: MMPY-198 Compliance Holds, Fraud Holds, and Banned Payees

- tags :: Falcon Nest Project Story Falcon Nest Project

- status :: Status - Complete

Description

In the creation and removal of holds from Chaturbate, we want to record the user

who performed the action. Implement an auth flow that explicitly sets the user.

Requirements

GIVEN

A CB staff user

WHEN

The CB user wants to add or remove a compliance hold (via another action they

have taken)

THEN

Provide a staff-user scoped token for that user and record the user who took the

add or removal action for the hold from the user in the token.

Tasks

DONE Add source_application_admin_username to API request body

ID

6087233e-0c62-7060-835e-b0bb9c6ddb1f

Fri Aug 15, 2025

DONE Add tests for new required API body parameter source_application_admin_username request body

ID

c4faa4f4-382e-c3b6-7594-4d66cbc57ea5

Fri Aug 15, 2025

Comments

- Note taken on Fri Aug 14, 202513:38

In standup today, @AaronIreland offered his opinion that this can be done two ways:

Inside the OAuth flow as a claim, similar to the is_banned claim

As a required parameter in the request body of API calls for certain source admin user endpoints

After talking it over, I think #2 is our preferred solution for right now. #1 is very robust and probably the “right way,” but it also would be more useful if we had lots of fine-grained authz to do against a source application admin user. In this case, all we want is an audit trail in Nest regarding who took a specific action from a given source application. Thus, requiring the CB app to send an associated user ID in the request should more than suffice for now.