From 1e1b8514550bda617a306858edbe7210c6f77b14 Mon Sep 17 00:00:00 2001
From: Stephen Rosenthal <stephen.rosenthal@datadoghq.com>
Date: Mon, 24 Aug 2026 16:39:34 -0700
Subject: [PATCH 1/2] pup: enable OAuth for DDSQL editor commands

Remove 3 dsql-editor tool endpoints from OAUTH_EXCLUDED_ENDPOINTS
so raw_get/raw_post send the OAuth bearer token for ddsql::spec,
ddsql::schema_tables, and ddsql::schema_columns commands.

Depends on server-side PR: dd-source#66615
---
 src/raw_client.rs | 31 +------------------------------
 1 file changed, 1 insertion(+), 30 deletions(-)

diff --git a/src/raw_client.rs b/src/raw_client.rs
index ed14c965..ed3347f2 100644
--- a/src/raw_client.rs
+++ b/src/raw_client.rs
@@ -120,19 +120,6 @@ fn find_endpoint_requirement(method: &str, path: &str) -> Option<&'static Endpoi
 /// Endpoints that don't support OAuth.
 /// Trailing "/" means prefix match for ID-parameterized paths.
 static OAUTH_EXCLUDED_ENDPOINTS: &[EndpointRequirement] = &[
-    // DDSQL editor tools (3)
-    EndpointRequirement {
-        path: "/api/unstable/ddsql-editor/tools/ddsql-docs",
-        method: "GET",
-    },
-    EndpointRequirement {
-        path: "/api/unstable/ddsql-editor/tools/table-names",
-        method: "GET",
-    },
-    EndpointRequirement {
-        path: "/api/unstable/ddsql-editor/tools/table-data",
-        method: "POST",
-    },
     // Fleet Automation (15)
     EndpointRequirement {
         path: "/api/v2/fleet/agents",
@@ -836,7 +823,7 @@ mod tests {
 
     #[test]
     fn test_oauth_excluded_count() {
-        assert_eq!(OAUTH_EXCLUDED_ENDPOINTS.len(), 46);
+        assert_eq!(OAUTH_EXCLUDED_ENDPOINTS.len(), 43);
     }
 
     #[test]
@@ -881,22 +868,6 @@ mod tests {
         ));
     }
 
-    #[test]
-    fn test_requires_api_key_fallback_ddsql_editor_tools() {
-        assert!(requires_api_key_fallback(
-            "GET",
-            "/api/unstable/ddsql-editor/tools/ddsql-docs"
-        ));
-        assert!(requires_api_key_fallback(
-            "GET",
-            "/api/unstable/ddsql-editor/tools/table-names"
-        ));
-        assert!(requires_api_key_fallback(
-            "POST",
-            "/api/unstable/ddsql-editor/tools/table-data"
-        ));
-    }
-
     #[test]
     fn test_no_fallback_for_error_tracking() {
         assert!(!requires_api_key_fallback(

From fa45ba843220d7721c0be4a2f4e7351d8e16be09 Mon Sep 17 00:00:00 2001
From: Stephen Rosenthal <stephen.rosenthal@datadoghq.com>
Date: Thu, 3 Sep 2026 11:23:15 -0700
Subject: [PATCH 2/2] ddsql: add ddsql_editor_read to default OAuth scopes

Without this, OAuth sessions get a 403 (permission denied) on the
ddsql-editor tool routes even after the OAuth exclusion is removed --
confirmed against prod. Per DAL-960, both changes are needed together.

Also drop the now-stale help text claiming these commands require
DD_API_KEY/DD_APP_KEY.
---
 src/auth/types.rs | 3 +++
 src/main.rs       | 3 +--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/auth/types.rs b/src/auth/types.rs
index f99358c1..59c2678c 100644
--- a/src/auth/types.rs
+++ b/src/auth/types.rs
@@ -65,6 +65,7 @@ pub fn read_only_scopes() -> Vec<&'static str> {
         "built_in_features",
         "data_scanner_read",
         "dbm_read",
+        "ddsql_editor_read",
         "error_tracking_read",
         "events_read",
         "feature_flag_config_read",
@@ -165,6 +166,8 @@ pub fn default_scopes() -> Vec<&'static str> {
         "data_scanner_read",
         // Data Streams
         "data_streams_monitoring_capture_messages",
+        // DDSQL Editor
+        "ddsql_editor_read",
         // Database Monitoring
         // built_in_features is required on US1/EU1 while the DBM team migrates to dbm_read.
         // Both are requested so the command works on all sites during the transition.
diff --git a/src/main.rs b/src/main.rs
index 8e7e01b6..b38ec327 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1145,8 +1145,7 @@ enum Commands {
     ///   pup ddsql schema columns --table-id public.aws.ec2_instance
     ///
     /// AUTHENTICATION:
-    ///   Query commands support OAuth2 (via 'pup auth login') or API key + Application key.
-    ///   Discovery commands (`spec`, `schema ...`) currently require DD_API_KEY + DD_APP_KEY.
+    ///   All ddsql commands support OAuth2 (via 'pup auth login') or API key + Application key.
     #[command(verbatim_doc_comment)]
     Ddsql {
         #[command(subcommand)]