add scope to resource for EntitlementExclusionGroup

Author: MarcusGoldschmidt

go.mod

@@ -3,7 +3,7 @@ module github.com/conductorone/baton-github
 go 1.25.2
 
 require (
-	github.com/conductorone/baton-sdk v0.9.14
+	github.com/conductorone/baton-sdk v0.9.16
 	github.com/deckarep/golang-set/v2 v2.9.0
 	github.com/ennyjfrick/ruleguard-logfatal v0.0.2
 	github.com/golang-jwt/jwt/v5 v5.2.2

go.sum

@@ -62,8 +62,8 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/conductorone/baton-sdk v0.9.14 h1:tRu3BAadvCUbdnqCKyvO58T7+y9/q6zG8h42D+QWgD8=
-github.com/conductorone/baton-sdk v0.9.14/go.mod h1:treFEoFwbzu9hgPqpCRD+Sr+p71xkeH98Y4ofDGrjSg=
+github.com/conductorone/baton-sdk v0.9.16 h1:/f9S1umZc7utfDXuWuNLkweCzqToo93LMLvhoNW8ABw=
+github.com/conductorone/baton-sdk v0.9.16/go.mod h1:treFEoFwbzu9hgPqpCRD+Sr+p71xkeH98Y4ofDGrjSg=
 github.com/conductorone/dpop v0.2.6 h1:fakwai/Xm2b/fcDUwJN41WtcSI/2UhQOyRIVvnnrrNA=
 github.com/conductorone/dpop v0.2.6/go.mod h1:gyo8TtzB9SCFCsjsICH4IaLZ7y64CcrDXMOPBwfq/3s=
 github.com/conductorone/dpop/integrations/dpop_grpc v0.2.4 h1:lYxYi9/WTSL9sE96CO0QF2BY3kehs8dTTApI134TGCA=

pkg/connector/repository.go

@@ -126,18 +126,23 @@ func (o *repositoryResourceType) List(ctx context.Context, parentID *v2.Resource
 }
 
 func (o *repositoryResourceType) Entitlements(_ context.Context, resource *v2.Resource, _ resourceSdk.SyncOpAttrs) ([]*v2.Entitlement, *resourceSdk.SyncOpResults, error) {
+	return nil, nil, nil
+}
+
+func (o *repositoryResourceType) StaticEntitlements(_ context.Context, _ resourceSdk.SyncOpAttrs) ([]*v2.Entitlement, *resourceSdk.SyncOpResults, error) {
 	rv := make([]*v2.Entitlement, 0, len(repoAccessLevels))
 	for i, level := range repoAccessLevels {
 		rv = append(rv, entitlement.NewPermissionEntitlement(
-			resource,
+			nil,
 			level,
 			entitlement.WithDisplayName(fmt.Sprintf("Repo %s", titleCase(level))),
 			entitlement.WithDescription(fmt.Sprintf("Access to repository in GitHub as %s", level)),
 			entitlement.WithGrantableTo(resourceTypeUser, resourceTypeTeam),
 			entitlement.WithAnnotation(&v2.EntitlementExclusionGroup{
-				ExclusionGroupId: "repository-permission-" + resource.GetId().GetResource(),
+				ExclusionGroupId: "repository",
 				Order:            uint32(i),
 				IsDefault:        level == repoPermissionPush,
+				ScopeToResource:  true,
 			}),
 		))
 	}