direct: Fix permissions state path to match input config schema#4703
Open
direct: Fix permissions state path to match input config schema#4703
Conversation
denik
requested review from
andrewnester,
anton-107,
pietern,
shreyas-goenka and
simonfaltum
as code owners
Collaborator
|
Commit: 7824eb6
22 interesting tests: 7 SKIP, 6 RECOVERED, 5 FAIL, 2 flaky, 1 KNOWN, 1 BUG
Top 33 slowest tests (at least 2 minutes):
|
denik
force-pushed
the
denik/permissions-reference
branch
from
66d736a to
cf0178e
Compare
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Introduces the __EMBED__ JSON tag convention. When a struct field has json:"__EMBED__", struct walkers treat it as transparent and don't add its name to the path. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fields with json:"__EMBED__" are walked at the parent path level, making their contents appear directly without the field name in paths. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fields with json:"__EMBED__" are walked at the parent path level in type traversal, consistent with Walk behavior. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When navigating a struct and the path expects an index or key-value selector, transparently navigate through the __EMBED__ field. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When setting a value at an index node and the parent is a struct, transparently navigate through the __EMBED__ field. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When validating paths with index, bracket-star, or key-value nodes on a struct type, transparently navigate through __EMBED__ fields. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fields with json:"__EMBED__" are diffed at the parent path level, consistent with how anonymous embedding works. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This makes the permissions slice appear at the root path of PermissionsState, matching the input config schema where permissions are accessed as resources.jobs.foo.permissions[0]. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The __EMBED__ convention on PermissionsState fixes the structaccess.Set() bug that prevented the direct engine from planning permissions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The __EMBED__ tag is for struct walkers only; JSON serialization must still use "permissions" as the field name. Add MarshalJSON/UnmarshalJSON to PermissionsState using a shadow struct. Regenerate all acceptance test outputs to reflect the corrected permission paths. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Struct walkers now check for EmbeddedSliceFieldName constant instead of parsing the __EMBED__ json tag via IsEmbed(). The IsEmbed() method is removed from JSONTag. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This reverts commit 410bd9b.
The splitResourcePath helper correctly routes references like
${resources.jobs.foo.permissions[0].level} to the permissions
sub-resource node instead of trying to find "permissions" field
on jobs.JobSettings.
Co-authored-by: Isaac
Add test that demonstrates cross-resource permission references:
job_a's permission levels reference job_b's permission levels via
${resources.jobs.job_b.permissions[0].level} syntax.
Fix splitResourcePath to correctly route permission sub-resource
references. Add level→permission_level field remapping since input
config uses "level" but state uses "permission_level".
Co-authored-by: Isaac
The plan JSON already verifies resolved permission levels. Deploy confirms the resolution succeeds end-to-end. Request recording disabled to avoid non-deterministic output ordering. Co-authored-by: Isaac
Co-authored-by: Isaac
…trolRequest This eliminates the level→permission_level field remapping since resources.Permission uses json:"level" matching the input config.
…deserialization StatePermission type has both "level" and "permission_level" JSON fields. UnmarshalJSON migrates old state files that used "permission_level" (from iam.AccessControlRequest) to the current "level" field. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
denik
force-pushed
the
denik/permissions-reference
branch
from
849df2a to
7824eb6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
EmbeddedSlicefield name convention to struct walkers inlibs/structs/— when a struct field is namedEmbeddedSlice, walkers treat it as transparent (no path segment added), so its elements appear directly at the parent pathPermissionsState: renamePermissionsfield toEmbeddedSlice, making state paths likeresources.jobs.foo.permissions[0]match input config paths (previouslyresources.jobs.foo.permissions.permissions[0])permissions.[*]→permissions[*](remove spurious dot before bracket)job_permissionsacceptance test for direct engineWhy
The direct deployment engine's permissions state used a wrapper struct that added an extra
permissionssegment to paths. This caused a mismatch with input config paths, preventing dependency tracking between permissions and their parent resources. With this fix, state and config paths are consistent.