refactor: remove Cloud API report usage scope to unblock cloud env deployment

packages/cli/src/commands/database/seed/tables.ts

@@ -181,8 +181,7 @@ export const seedTables = async (
         ({ name }) =>
           name === CloudScope.SendSms ||
           name === CloudScope.SendEmail ||
-          name === CloudScope.FetchCustomJwt ||
+          name === CloudScope.FetchCustomJwt
-          name === CloudScope.ReportSubscriptionUpdates
       )
       .map(({ id }) => id)
   );

packages/core/src/libraries/cloud-connection.ts

@@ -29,13 +29,8 @@ const accessTokenResponseGuard = z.object({
  * The scope here can be empty and still work, because the cloud API requests made using this client do not rely on scope verification.
  * The `CloudScope.SendEmail` is added for now because it needs to call the cloud email service API.
  * The `CloudScope.FetchCustomJwt` is added for now because it needs to call the cloud custom JWT service API.
- * The `CloudScope.ReportSubscriptionUpdates` is added since we need to report subscription updates to the cloud.
  */
-const scopes: string[] = [
+const scopes: string[] = [CloudScope.SendEmail, CloudScope.FetchCustomJwt];
-  CloudScope.SendEmail,
-  CloudScope.FetchCustomJwt,
-  CloudScope.ReportSubscriptionUpdates,
-];
 const accessTokenExpirationMargin = 60;
 
 /** The library for connecting to Logto Cloud service. */

packages/schemas/alterations/next-1724229102-add-report-sub-updates-cloud-scope.ts

@@ -1,93 +0,0 @@
-import { sql } from '@silverhand/slonik';
-
-import type { AlterationScript } from '../lib/types/alteration.js';
-
-import { generateStandardId } from './utils/1716643968-id-generation.js';
-
-type Resource = {
-  tenantId: string;
-  id: string;
-  name: string;
-  indicator: string;
-  isDefault: boolean;
-};
-
-type Scope = {
-  tenantId: string;
-  id: string;
-  resourceId: string;
-  name: string;
-  description: string;
-};
-
-type Role = {
-  tenantId: string;
-  id: string;
-  name: string;
-  description: string;
-};
-
-const cloudApiIndicator = 'https://cloud.logto.io/api';
-
-const cloudConnectionAppRoleName = 'tenantApplication';
-
-const adminTenantId = 'admin';
-
-const reportSubscriptionUpdatesScopeName = 'report:subscription:updates';
-const reportSubscriptionUpdatesScopeDescription =
-  'Allow reporting changes on Stripe subscription to Logto Cloud.';
-
-const alteration: AlterationScript = {
-  up: async (pool) => {
-    // Get the Cloud API resource
-    const cloudApiResource = await pool.one<Resource>(sql`
-      select * from resources
-      where tenant_id = ${adminTenantId}
-      and indicator = ${cloudApiIndicator}
-    `);
-
-    // Get cloud connection application role
-    const tenantApplicationRole = await pool.one<Role>(sql`
-      select * from roles
-      where tenant_id = ${adminTenantId}
-      and name = ${cloudConnectionAppRoleName} and type = 'MachineToMachine'
-    `);
-
-    // Create the `report:subscription:updates` scope
-    const reportSubscriptionUpdatesCloudScope = await pool.one<Scope>(sql`
-      insert into scopes (id, tenant_id, resource_id, name, description)
-      values (${generateStandardId()}, ${adminTenantId}, ${
-        cloudApiResource.id
-      }, ${reportSubscriptionUpdatesScopeName}, ${reportSubscriptionUpdatesScopeDescription})
-      returning *;
-    `);
-
-    // Assign the `report:subscription:updates` scope to cloud connection application role
-    await pool.query(sql`
-      insert into roles_scopes (id, tenant_id, role_id, scope_id)
-      values (${generateStandardId()}, ${adminTenantId}, ${tenantApplicationRole.id}, ${
-        reportSubscriptionUpdatesCloudScope.id
-      });
-    `);
-  },
-  down: async (pool) => {
-    // Get the Cloud API resource
-    const cloudApiResource = await pool.one<Resource>(sql`
-      select * from resources
-      where tenant_id = ${adminTenantId}
-      and indicator = ${cloudApiIndicator}
-    `);
-
-    // Remove the `report:subscription:updates` scope
-    await pool.query(sql`
-      delete from scopes
-      where
-        tenant_id = ${adminTenantId} and
-        name = ${reportSubscriptionUpdatesScopeName} and
-        description = ${reportSubscriptionUpdatesScopeDescription} and
-        resource_id = ${cloudApiResource.id}
-    `);
-  },
-};
-
-export default alteration;

packages/schemas/src/seeds/cloud-api.ts

@@ -22,10 +22,6 @@ export enum CloudScope {
    * scripts and fetch the parsed token payload.
    */
   FetchCustomJwt = 'fetch:custom:jwt',
-  /**
-   * The entity can report changes on Stripe subscription to Logto Cloud.
-   */
-  ReportSubscriptionUpdates = 'report:subscription:updates',
   /** The user can see and manage affiliates, including create, update, and delete. */
   ManageAffiliate = 'manage:affiliate',
   /** The user can create new affiliates and logs. */
@@ -74,10 +70,6 @@ export const createCloudApi = (): Readonly<[UpdateAdminData, ...CreateScope[]]>
       CloudScope.FetchCustomJwt,
       'Allow accessing external resource to execute JWT payload customizer script and fetch the parsed token payload.'
     ),
-    buildScope(
-      CloudScope.ReportSubscriptionUpdates,
-      'Allow reporting changes on Stripe subscription to Logto Cloud.'
-    ),
     buildScope(CloudScope.CreateAffiliate, 'Allow creating new affiliates and logs.'),
     buildScope(
       CloudScope.ManageAffiliate,