From 2e09009e11fadad616c82a540f3685a790dba94d Mon Sep 17 00:00:00 2001
From: Chris Farhood <chris@farhood.org>
Date: Sat, 4 Jul 2026 20:58:24 -0400
Subject: [PATCH] feat(oidc): request configurable scopes incl. groups (admin
 gate)

---
 .coverage                         | Bin 53248 -> 53248 bytes
 src/intervalsicu_mcp_ui/app.py    |   2 +-
 src/intervalsicu_mcp_ui/config.py |   2 ++
 tests/test_app.py                 |   1 +
 4 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.coverage b/.coverage
index f05cef0c561dc6435d963b9b7163880f967ac618..c279b8dc095a5479f9cbdce3034d80c0bf76a299 100644
GIT binary patch
delta 16
XcmZozz}&EadBc}JM*q!U`?wteKGX+G

delta 16
XcmZozz}&EadBc}JM)l2K`?wteJ>&-?

diff --git a/src/intervalsicu_mcp_ui/app.py b/src/intervalsicu_mcp_ui/app.py
index eb95a0c..384870b 100644
--- a/src/intervalsicu_mcp_ui/app.py
+++ b/src/intervalsicu_mcp_ui/app.py
@@ -40,7 +40,7 @@ def create_app(config: Config | None = None) -> FastAPI:
         server_metadata_url=f"{cfg.oidc_issuer}.well-known/openid-configuration",
         client_id=cfg.oidc_client_id,
         client_secret=cfg.oidc_client_secret,
-        client_kwargs={"scope": "openid email profile"},
+        client_kwargs={"scope": cfg.oidc_scopes},
     )
 
     app = FastAPI(title="Intervals.icu MCP portal")
diff --git a/src/intervalsicu_mcp_ui/config.py b/src/intervalsicu_mcp_ui/config.py
index cd46b57..1d1d143 100644
--- a/src/intervalsicu_mcp_ui/config.py
+++ b/src/intervalsicu_mcp_ui/config.py
@@ -16,6 +16,7 @@ class Config:
     session_secret: str
     admin_group: str
     intervals_api_base: str
+    oidc_scopes: str
 
 
 def load_config() -> Config:
@@ -28,4 +29,5 @@ def load_config() -> Config:
         session_secret=os.environ["SESSION_SECRET"],
         admin_group=os.environ.get("ADMIN_GROUP", "intervalsicu-mcp-admins"),
         intervals_api_base=os.environ.get("INTERVALS_API_BASE_URL", "https://intervals.icu/api/v1"),
+        oidc_scopes=os.environ.get("OIDC_SCOPES", "openid email profile groups"),
     )
diff --git a/tests/test_app.py b/tests/test_app.py
index c33e76f..e2d366f 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -40,6 +40,7 @@ def app_url(tmp_path, monkeypatch):
         session_secret="x" * 32,
         admin_group="intervalsicu-mcp-admins",
         intervals_api_base="https://intervals.icu/api/v1",
+        oidc_scopes="openid email profile groups",
     )
     return appmod.create_app(cfg), url