From 988e39b096a969ec66ec2b1710d6ffbf7acc2c02 Mon Sep 17 00:00:00 2001
From: Scott Kennedy <scott.kennedy@datadoghq.com>
Date: Wed, 20 May 2026 10:46:32 -0400
Subject: [PATCH] Add Actions Datastore OAuth scopes

---
 src/auth/types.rs | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/auth/types.rs b/src/auth/types.rs
index c3d9067..23130de 100644
--- a/src/auth/types.rs
+++ b/src/auth/types.rs
@@ -41,7 +41,13 @@ pub struct ClientCredentials {
 
 /// All known valid OAuth scopes for validation.
 pub fn all_known_scopes() -> Vec<&'static str> {
-    default_scopes()
+    let mut scopes = default_scopes();
+    scopes.extend([
+        "apps_datastore_manage",
+        "apps_datastore_read",
+        "apps_datastore_write",
+    ]);
+    scopes
 }
 
 /// Read-only OAuth scopes for use with --read-only flag.
@@ -323,7 +329,14 @@ mod tests {
 
     #[test]
     fn test_all_known_scopes_matches_default() {
-        assert_eq!(all_known_scopes(), default_scopes());
+        let known = all_known_scopes();
+        let default: std::collections::HashSet<&str> = default_scopes().into_iter().collect();
+        for scope in default {
+            assert!(known.contains(&scope));
+        }
+        assert!(known.contains(&"apps_datastore_manage"));
+        assert!(known.contains(&"apps_datastore_read"));
+        assert!(known.contains(&"apps_datastore_write"));
     }
 
     #[test]