Repository navigation
fix: Reject unknown resource types and actions in the REST permission API - #6951
Merged
ntkathole merged 1 commit intoOct 7, 2026
Merged
ntkathole merged 1 commit into
ntkathole merged 1 commit into
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
Copy link
Copy Markdown
|
⚠️ Please install the Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## master #6951 +/- ##
==========================================
+ Coverage 49.08% 49.14% +0.05%
==========================================
Files 433 433
Lines 54332 54338 +6
Branches 7917 7918 +1
==========================================
+ Hits 26667 26702 +35
+ Misses 25788 25761 -27
+ Partials 1877 1875 -2
... and 4 files with indirect coverage changes Continue to review full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Sorry, something went wrong.
ntkathole
force-pushed
the
fix/rest-permission-unknown-types
branch
from
362415b to
19708b0
Compare
October 7, 2026 04:43
ntkathole
approved these changes
Oct 7, 2026
… API apply_permission silently dropped any type or action name that was not in the name-to-enum maps. A typo or wrong casing in every type left the spec with an empty types list, which Permission treats as ALL_RESOURCE_TYPES, so a permission meant for one resource type ended up covering all of them. Partially invalid action lists were also narrowed without notice. Return a 400 listing the invalid names and the valid options instead. Signed-off-by: LuisFigueroaG <luis.h.figueroa.g@gmail.com>
ntkathole
force-pushed
the
fix/rest-permission-unknown-types
branch
from
19708b0 to
e2e2c71
Compare
October 7, 2026 05:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
POST /permissions silently dropped any type or action name it did not recognize:
A typo or wrong casing in every type (e.g. "feature_view" instead of "FEATURE_VIEW") left the spec with an empty types list, which Permission treats as ALL_RESOURCE_TYPES. So a permission meant for one resource type was stored covering all 12 of them, with a 201. A partly invalid action list such as ["DESCRIBE", "READ"] was also narrowed to ["DESCRIBE"] without any notice.
The endpoint now returns a 400 that lists the invalid names and the valid options, consistent with the other 400s in the REST registry API. Valid requests behave as before.
Which issue(s) this PR fixes:
No existing issue.
Checks
Testing Strategy
Added REST tests in test_api_rest_registry.py for the valid apply/get/delete path and for rejecting unknown types and actions (lowercase type, a typo among valid types, lowercase action, partly invalid actions). Each rejection test also checks that nothing was stored. The rejection tests fail on master and pass with this change. ruff format --check, ruff check and mypy pass on the changed files, and pytest sdk/python/tests/unit/api passes (139 passed, 6 skipped).