Merge branch 'main' into sc-UID2-6903-add-okta-scope

Author: sophia-chen-ttd

.trivyignore

@@ -21,4 +21,4 @@ GHSA-72hv-8253-57qq exp:2026-09-01
 # gateway) so anonymous external attackers cannot reach the netty epoll socket directly;
 # LB-level connection limits and idle timeouts further cap the blast radius. CVSS impact is
 # Availability only (C:N/I:N/A:H). Tracking via UID2-7035; revisit on vert.x 5 migration.
-CVE-2026-42577 exp:2026-06-08
+CVE-2026-42577 exp:2026-09-11

pom.xml

@@ -6,7 +6,7 @@
 
     <groupId>com.uid2</groupId>
     <artifactId>uid2-admin</artifactId>
-    <version>6.13.39-alpha-247-SNAPSHOT</version>
+    <version>6.13.39-alpha-248-SNAPSHOT</version>
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -18,7 +18,7 @@
         <junit-jupiter.version>5.11.2</junit-jupiter.version>
         <uid2-shared.version>11.4.21-alpha-349-SNAPSHOT</uid2-shared.version>
         <okta-jwt.version>0.5.10</okta-jwt.version>
-        <netty.version>4.1.133.Final</netty.version>
+        <netty.version>4.1.135.Final</netty.version>
         <image.version>${project.version}</image.version>
     </properties>
 

src/main/java/com/uid2/admin/auth/OktaCustomScope.java

@@ -8,6 +8,7 @@
 @Getter
 public enum OktaCustomScope {
     SS_PORTAL("uid2.admin.ss-portal", Role.SHARING_PORTAL),
+    EUID_SS_PORTAL("euid.admin.ss-portal", Role.SHARING_PORTAL),
     SECRET_ROTATION("uid2.admin.secret-rotation", Role.SECRET_ROTATION),
     SITE_SYNC("uid2.admin.site-sync", Role.PRIVATE_OPERATOR_SYNC),
     METRICS_EXPORT("uid2.admin.metrics-export", Role.METRICS_EXPORT),

src/main/resources/localstack/s3/core/operators/operators.json

@@ -128,5 +128,21 @@
     "key_hash": "rx3SYxt2PdnIIbhGMc0Cue3/JTk9WwyDiMMOp5WiU6pXbdkhjZ+BxgIChzMMZeLqAi/E4G5XZHMFnOe8Zzx3jg==",
     "key_salt": "0L8h9CSPfDFEHurZZ33OOogd26zSjApBTWLmYHtauC8=",
     "key_id": "UID2-O-L-127-pDqph"
+  },
+  {
+    "key": "UID2-O-L-998-d1sabledKeyForE2ETestOnly00000000000000000000=",
+    "name": "Disabled Operator (E2E)",
+    "contact": "Disabled Operator (E2E)",
+    "protocol": "trusted",
+    "created": 1618873215,
+    "disabled": true,
+    "roles": [
+      "OPERATOR"
+    ],
+    "site_id": 998,
+    "operator_type": "PRIVATE",
+    "key_hash": "PyhHif4ptfrwvk6tFo7da/OR4TeQlejhUKvIvseMD1F9Wz0jTaWt0DfrKNEmdYvl7C0CxmEWbIT2wY+2kXoQOw==",
+    "key_salt": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
+    "key_id": "UID2-O-L-998-d1sab"
   }
 ]

src/test/java/com/uid2/admin/auth/OktaCustomScopeTest.java

@@ -1,6 +1,8 @@
 package com.uid2.admin.auth;
 
+import com.uid2.shared.auth.Role;
 import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
@@ -24,4 +26,11 @@ private static Stream<Arguments> testFromNameData() {
     public void testFromName(final String name, final OktaCustomScope scope) {
         Assertions.assertEquals(scope, OktaCustomScope.fromName(name));
     }
+
+    @Test
+    void euidSsPortalScopeIsRecognised() {
+        OktaCustomScope scope = OktaCustomScope.fromName("euid.admin.ss-portal");
+        Assertions.assertNotNull(scope);
+        Assertions.assertEquals(Role.SHARING_PORTAL, scope.getRole());
+    }
 }