raystack / frontier / 29997227049

47%

main: 47%

Build Type

Pull #1797

github

Committed by rohilsurana

Commit Message

fix(reconcile): validate the permission namespace charset at plan time

The permission slug is service_resource_verb joined with "_", but the namespace charset was never checked, only the verb. So a namespace with an underscore in a part (resource_order/item) flattened to the same slug as a differently-spelled one (resource/order_item) and was silently treated as already present: the diff planned zero ops while the desired state differed (rule 2), and nothing ever detected it (rule 4). Add IsValidPermissionNamespace (each of service/resource lowercase alphanumeric, no underscore) and call it from validatePermissionSpec, so an ambiguous namespace fails the plan up front. Reconcile-side only; the rule sits inside SpiceDB's object-type grammar, so it never rejects a namespace the server could store, except the ambiguous underscore ones the fix targets.

Pull Request Pull Request #1797: fix(reconcile): validate the permission namespace charset at plan time

Coverage Stats

17 of 17 new or added lines in 2 files covered. (100.0%)

2 existing lines in 1 file now uncovered.

18183 of 38938 relevant lines covered (46.7%)

14.32 hits per line