Repository navigation
feat(sharing): per-resource-type share roles, incl. a role that manages shares (#707) - #719
Merged
Merged
Conversation
Validate share role ids at registration; one resolve_roles helper; changelog deprecation under Deprecated. Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4
Role ids use fullmatch (a trailing newline passed); docs and changelog notes. Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4
Deploying simple-module-python with
|
| Latest commit: |
1d6aa92
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://a020930f.simple-module-python.pages.dev |
| Branch Preview URL: | https://feat-b32-sharing-roles.simple-module-python.pages.dev |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resource types can now declare their own sharing roles, including a role that lets a non-owner manage shares.
Closes #707
What changed
ResourceType.share_roles(keyword-only): a mapping of role id → the actions it implies, e.g.{"viewer": ("view",), "contributor": ("view", "edit"), "manager": ("view", "edit", "share")}.Nonekeeps today'sview/editroles.view, since visibility decides 404 versus 403.roles_granting(action, roles=…),share_exists_for(type, id_col, roles=…)andresolve_roles().grant()validates the role against the type's mapping.ResourceTypeand toshare_exists_for; the docs and a wiring test cover it.ACTION_SHARElets its holder list, grant and revoke shares on that resource, for any role the type declares (no ranking, per the approved design). The API'ssharing.sharepermission gate still applies.ResourceType.shareable_actions(remove_in="0.1.0", listed intest_deprecation_expiry). view/edit subsets keep working through the shim.Noneinstead of("view", "edit"); readshare_roles.ResourceShare.roleis already a string.Verification
make lint✓ ·make test-js✓ ·make test-py✓ (6591 passed, 41 skipped)test_sharing_custom_roles.py: default compatibility; two types with different roles; custom-action SQL access; manager grant, list and revoke; viewer refused; unknown role; expiry; cross-tenant; role-id validation (including a trailing newline thatmatch+$let through, which review caught); deprecation shim.fullmatchbug, changelog placement, docs. Rejected findings are recorded with reasons.https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4