fix(restriction_policies): drop stale principals instead of skipping the whole policy (2/4)#630
Draft
michael-richey wants to merge 1 commit into
Conversation
…the whole policy Overrides `connect_resources` so that, under `--drop-unresolvable-principals`, a principal absent from both destination and source state (permanently gone — e.g. a role deleted before the org's first-ever import) is dropped from its binding and the policy still syncs, instead of the entire restriction policy being skipped on a single dead reference. - Principals present in source but not destination keep today's hard-fail/retry behavior. - If dropping empties a binding whose source list was non-empty, the resource is still skipped and flagged as an access-elevation risk (ERROR + metric), governed by `--skip-failed-resource-connections` like any other connection failure. - The "id" (dashboard/slo/notebook) connections keep the generic path unchanged. - `extract_source_ids` is intentionally left unaffected (documented) so minimize-reads lazy-loading can still resolve which principals to check. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
michael-richey
force-pushed
the
drop-unresolvable-principals-scaffolding
branch
from
7db6366 to
a7514ad
Compare
michael-richey
force-pushed
the
drop-unresolvable-principals-restriction-policies
branch
from
c0fbb7e to
76bcbff
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Stacked PR 2 of 4. Base:
drop-unresolvable-principals-scaffolding(PR #629). This is the confirmed incident fix.This PR
Overrides
connect_resourcesonRestrictionPoliciesso that, under--drop-unresolvable-principals, a principal absent from both destination and source (permanently gone — e.g. a role deleted before the org's first-ever import) is dropped from its binding and the policy still syncs, instead of the whole restriction policy being skipped on a single dead reference.risk:empty_restriction_policymetric), governed by--skip-failed-resource-connectionslike any other connection failure.extract_source_idsintentionally left unaffected (documented) so--minimize-readslazy-loading can still resolve which principals to check.Testing
New
TestRestrictionPoliciesConnectResourcessuite: flag off (unchanged), drop-and-continue, source-present hard-fail, empty-binding risk, multi-binding partial-empty,skip_failed_resource_connectionsinteraction, middle-element index-shift regression,extract_source_idsunaffected, org/non-composite pass-through, and a dangling-id guard. Green;ruffclean.🤖 Generated with Claude Code