Repository navigation
Fix the GitHub install admin tests that broke main - #1698
Merged
Merged
Conversation
Maple review🟢 Confidence 10/10 · safe to merge Passes the
What was checked
|
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 20 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Thegreatsura
pushed a commit
to Thegreatsura/maple-analytics
that referenced
this pull request
Oct 23, 2026
…#1635) * feat(integrations): connect an AWS account as a source An AWS connection is a pull source backed by an IAM role in the customer's account. Maple mints an external id, the customer deploys a generated CloudFormation stack (CloudShell script, console template or Terraform), and Maple assumes the role from its own identity to confirm the setup. No AWS secret is stored. - aws_connections table (source_id required, cascades with its source), AwsConnectionService and /v2/integrations/aws (status, create, update, setup, check, delete). - The role trusts Maple's account root, conditioned on the exact principal ARN and the connection's external id. Its name is derived from the connection id, so a caller can never point Maple at another role. - Each future module (metrics, inventory, security, cost) is its own policy on the same role; the check reads which are attached and the setup version tag, so a new module is a stack update, not a reconnect. - Hourly alerting lane re-checks connections: paused sources are skipped in SQL, the batch is claimed in one statement, two checks run at a time. A deleted stack reports the source disconnected; AWS outages only record the error. - Connect card under Sources: account form, setup panel that re-checks every 10s while open, connection health, disconnect with a cleanup script kept until dismissed. - Docs page integrations/aws. * chore(aws): regenerate the iOS OpenAPI spec and anticipated error identifiers * fix(aws): the unavailable card drops the steps it cannot offer * fix(aws): a background check only closes its own setup; pending setup is not a failure * fix(aws): the hourly sweep runs batches until nothing is due, never-checked first * fix(aws): a sweep checks its batch in due order, never-checked first * fix(aws): no check starts past the sweep budget * fix(aws): a disconnect closes only its own dialog; document and test PATCH A completed disconnect read the last-clicked connection, so it could close another connection's dialog and setup. The update request now documents that omitted modules stay unchanged, and update is tested in the service and route. * test(web): the in-flight click case starts a poll before it clicks The case clicked a page with no check in flight, so it never reached the flip that makes a background check the user's. * test(aws): the budget sweep allows a check that timed out unassumed Two checks run at once and each fake call jumps the shared clock 9s, so a call can pass its 20s timeout and count as checked without an AssumeRole. * fix(web): an AWS stack that needs updating reads as needing attention The hub card, sources picker and header now agree with the connection row. * test(aws): another org's admin cannot see or touch a connection; members cannot check it * test(github): pass the initiator in the install admin cases Same one-line fix as MapleTechLabs#1698: main's MapleTechLabs#1675 and MapleTechLabs#1685 crossed, so these cases called completeConnect without the initiator MapleTechLabs#1675 made required.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Main has failed 6
GithubConnectServicetests since #1685 landed. Its new account-admin cases callcompleteConnectwithout the initiator that #1675 made required, so the call is rejected before the org role lookup and every case sees no role URLs.This passes
INITIATORlike the neighbouring tests. The cases still assert the security behaviour: a non-admin, a pending invite, an unreadable role and another user's account are refused after the role lookup; an active org admin and the user's own account are bound.Verified:
GithubConnectService.test.ts28/28 on current main (6 failing before).🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need.