From 6a5cd365d321b914b6a7a6b9de879db81105fa78 Mon Sep 17 00:00:00 2001 From: Michael Malave Date: Mon, 14 Sep 2026 15:52:37 -0700 Subject: [PATCH 1/2] Task 4: add --team flag to authorizations:create (W-24132433) Adds --team to `heroku authorizations:create` so the created OAuth authorization can be owned by a named team. When --team is set, the command POSTs to /teams/${team}/oauth/authorizations (team value encodeURIComponent'd); otherwise it keeps the existing /oauth/authorizations user path. Existing flags (--description, --expires-in, --scope, --json, --short) and the POST body are unchanged. --- src/commands/authorizations/create.ts | 7 ++++++- .../commands/authorizations/create.unit.test.ts | 14 ++++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/src/commands/authorizations/create.ts b/src/commands/authorizations/create.ts index 15631233b9..0128d16c02 100644 --- a/src/commands/authorizations/create.ts +++ b/src/commands/authorizations/create.ts @@ -18,6 +18,7 @@ export default class AuthorizationsCreate extends Command { json: flags.boolean({char: 'j', description: 'output in json format'}), scope: flags.string({char: 's', completion: ScopeCompletion, description: 'set custom OAuth scopes'}), short: flags.boolean({char: 'S', description: 'only output token'}), + team: flags.team(), } async run() { @@ -25,7 +26,11 @@ export default class AuthorizationsCreate extends Command { ux.action.start('Creating OAuth Authorization') - const {body: auth} = await this.heroku.post('/oauth/authorizations', { + const endpoint = flags.team + ? `/teams/${encodeURIComponent(flags.team)}/oauth/authorizations` + : '/oauth/authorizations' + + const {body: auth} = await this.heroku.post(endpoint, { body: { description: flags.description, expires_in: flags['expires-in'], diff --git a/test/unit/commands/authorizations/create.unit.test.ts b/test/unit/commands/authorizations/create.unit.test.ts index c4cf04b39a..88d9974c59 100644 --- a/test/unit/commands/authorizations/create.unit.test.ts +++ b/test/unit/commands/authorizations/create.unit.test.ts @@ -53,4 +53,18 @@ describe('authorizations:create', function () { expect(json.scope).to.contain('global') }) }) + + context('with team flag', function () { + it('creates the authorization for the team', async function () { + api + .post('/teams/my-team/oauth/authorizations', {description: 'awesome'}) + .reply(201, {access_token: {token: 'secrettoken'}, scope: ['global']}) + + const {stdout} = await runCommand(AuthorizationsCreate, ['--description', 'awesome', '--team', 'my-team']) + + expect(stdout).to.contain('Client: \n') + expect(stdout).to.contain('Scope: global\n') + expect(stdout).to.contain('Token: secrettoken\n') + }) + }) }) From dce4ae870dc3cc85c72f8f695145530733d7b658 Mon Sep 17 00:00:00 2001 From: Michael Malave Date: Tue, 15 Sep 2026 09:40:47 -0700 Subject: [PATCH 2/2] fix: send version=3.sdk Accept header on --team authorizations:create The team-owned authorizations API route (/teams/:team/oauth/authorizations) is gated behind the 3.sdk API variant; without the Accept header the request 404s. Send SDK_HEADER on the --team path only and assert it in the team test. --- src/commands/authorizations/create.ts | 2 ++ test/unit/commands/authorizations/create.unit.test.ts | 1 + 2 files changed, 3 insertions(+) diff --git a/src/commands/authorizations/create.ts b/src/commands/authorizations/create.ts index 0128d16c02..bdd172ead9 100644 --- a/src/commands/authorizations/create.ts +++ b/src/commands/authorizations/create.ts @@ -5,6 +5,7 @@ import {hux} from '@heroku/heroku-cli-util' import * as color from '@heroku/heroku-cli-util/color' import {ux} from '@oclif/core/ux' +import {SDK_HEADER} from '../../lib/api.js' import {display} from '../../lib/authorizations/authorizations.js' export default class AuthorizationsCreate extends Command { @@ -36,6 +37,7 @@ export default class AuthorizationsCreate extends Command { expires_in: flags['expires-in'], scope: flags.scope ? flags.scope.split(',') : undefined, }, + ...(flags.team ? {headers: {Accept: SDK_HEADER}} : {}), }) ux.action.stop() diff --git a/test/unit/commands/authorizations/create.unit.test.ts b/test/unit/commands/authorizations/create.unit.test.ts index 88d9974c59..255afab37b 100644 --- a/test/unit/commands/authorizations/create.unit.test.ts +++ b/test/unit/commands/authorizations/create.unit.test.ts @@ -57,6 +57,7 @@ describe('authorizations:create', function () { context('with team flag', function () { it('creates the authorization for the team', async function () { api + .matchHeader('accept', 'application/vnd.heroku+json; version=3.sdk') .post('/teams/my-team/oauth/authorizations', {description: 'awesome'}) .reply(201, {access_token: {token: 'secrettoken'}, scope: ['global']})