raystack / frontier / 27262800362
43%
main: 47%

LAST BUILD BRANCH: dependabot/go_modules/google.golang.org/grpc-1.82.1
DEFAULT BRANCH: main
Ran
Jobs 1
Files 276
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 43.276% (-0.1%) from 43.371%
27262800362

Pull #1685

github

whoAbhishekSah 
fix(permission): cascade role->permission tuple cleanup on delete

permission.Delete only removed the DB row. Every role granting the
permission keeps app/role:<role>#<slug>@<*> tuples (one per principal
type), so deleting a permission left those tuples dangling on a relation no
longer backed by any permission row. The method was also unreachable: the
DeletePermission RPC was hardwired to "function not available".

Changes:
- permission.Service gains a relation dependency and, on Delete, sweeps the
  role->permission tuples by object-namespace (app/role) + relation-name
  (the permission slug), clearing them across all roles and principal types
  before removing the row. Tolerates ErrNotExist for unused permissions.
- Implement the DeletePermission admin handler and gate it on superuser
  (previously returned CodeUnavailable), making the guard reachable and
  giving the data-cleanup effort a way to remove stray permissions.

Adds an e2e regression test: create a permission, build a role on it,
delete the permission, assert no role->permission tuple remains. Verified
it fails without the sweep (tuple lingers) and passes with it.

Refs #1661

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pull Request #1685: fix(permission): clean up leftover access in SpiceDB when a permission is deleted

30 of 147 new or added lines in 8 files covered. (20.41%)

39 existing lines in 5 files now uncovered.

16074 of 37143 relevant lines covered (43.28%)

12.3 hits per line

Uncovered Changes

Lines Coverage ∆ File
58
57.21
 -25.52% internal/api/v1beta1connect/permission.go
20
28.87
 -2.19% internal/bootstrap/service.go
15
71.91
 -5.25% internal/store/postgres/role_repository.go
15
0.0
 0.0% internal/store/spicedb/relation_repository.go
6
0.0
 0.0% cmd/serve.go
2
91.67
 -8.33% core/permission/service.go
1
0.0
 0.0% pkg/server/connect_interceptors/authorization.go

Coverage Regressions

Lines Coverage ∆ File
28
28.87
 -2.19% internal/bootstrap/service.go
6
57.21
 -25.52% internal/api/v1beta1connect/permission.go
2
91.67
 -8.33% core/permission/service.go
2
54.13
 0.64% core/role/service.go
1
71.91
 -5.25% internal/store/postgres/role_repository.go
Jobs
ID Job ID Ran Files Coverage
1 27262800362.1 276
43.28
 GitHub Action Run
Source Files on build 27262800362