fix(gcp): allow org-level discovery when Projects.List returns zero results#737
Merged
fix(gcp): allow org-level discovery when Projects.List returns zero results#737
Conversation
…esults
When organization_id is set without project_ids, the SA may not have
resourcemanager.projects.list permission but can still query the Asset API
at the organization scope. Previously, the code unconditionally failed with
"no projects available for organization discovery" which blocked org-level
discovery for these SAs.
Now project listing failures are logged as warnings and the provider
proceeds with org-level Asset API calls (organizations/{id}), which is
the intended fallback path in Resources().
Configured project_ids are still strictly validated — only the
auto-discovery path is made lenient.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Neo - PR Security ReviewNo security issues found Highlights
Hardening Notes
Comment |
Contributor
WalkthroughThis PR defers Cloud Resource Manager service creation to specific code paths and improves project validation workflow. When configured projects are provided, they're resolved using enrichWithProjectNumbers(). Invalid projects trigger an error. The "no configured projects" path now logs warnings instead of failing immediately, enabling fallback to organization-level discovery. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
pkg/providers/gcp/gcp.go (1)
765-780:⚠️ Potential issue | 🟠 MajorConfigured-project validation never rejects unresolved IDs.
projectScope.enrichWithProjectNumbers()inpkg/providers/gcp/gcp.goLines 1104-1127 only augments the scope; it never removes entries whoseProjects.Getlookup fails. Because Line 776 then copiesscope.listIDs()back intoprojects, the new check at Lines 778-780 is effectively unreachable for any non-emptyproject_idsinput. An all-invalid or inaccessible configured list will still create a provider and only fail later during asset discovery.Suggested fix
resolvedIDs := make([]string, 0, len(ps.orderedIDs)) resolvedAllowedIDs := make(map[string]struct{}, len(ps.orderedIDs)) resolvedAllowedNumbers := make(map[string]struct{}, len(ps.orderedIDs)) for _, id := range ps.orderedIDs { project, err := manager.Projects.Get(id).Context(ctx).Do() if err != nil { if firstErr == nil { firstErr = err } continue } if project.ProjectId == "" { continue } resolvedIDs = append(resolvedIDs, project.ProjectId) resolvedAllowedIDs[project.ProjectId] = struct{}{} if project.ProjectNumber != 0 { number := strconv.FormatInt(project.ProjectNumber, 10) resolvedAllowedNumbers[number] = struct{}{} } } ps.orderedIDs = resolvedIDs ps.allowedIDs = resolvedAllowedIDs ps.allowedNumbers = resolvedAllowedNumbers🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/providers/gcp/gcp.go` around lines 765 - 780, The project-scope enrichment currently only augments entries and doesn't remove IDs that fail lookup, so update projectScope.enrichWithProjectNumbers to filter out unresolved projects: iterate ps.orderedIDs, call manager.Projects.Get(id).Context(ctx).Do(), skip entries that return an error or have empty ProjectId, and build new slices/maps (resolvedIDs, resolvedAllowedIDs, resolvedAllowedNumbers) and then assign them back to ps.orderedIDs, ps.allowedIDs, ps.allowedNumbers; preserve recording the first lookup error (firstErr) for reporting but do not retain failed IDs in the scope so that listIDs() returns only resolved project IDs and the subsequent empty-check works as intended.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pkg/providers/gcp/gcp_test.go`:
- Around line 11-57: The tests currently call newOrganizationProvider() against
real GCP calls and use empty project_ids which get normalized to nil by
getProjectIDsFromOptions(), so they don't exercise the configured-project
validation; update the tests to inject a mocked client factory (or replace the
client creation hook used by newOrganizationProvider) that simulates
Projects.List returning empty/invalid results and add a case with a non-empty
invalid "project_ids" string to force the configured-project validation path;
specifically, modify
TestNewOrganizationProvider_ConfiguredProjectsStillValidated to provide a mocked
factory that returns no projects for the given IDs and assert that
newOrganizationProvider returns the expected validation error, and keep
TestNewOrganizationProvider_NoProjectsListedFallsBackToOrgLevel using a mocked
factory that returns an error or empty list but with organization_id and no
project_ids to verify org-level behavior.
---
Outside diff comments:
In `@pkg/providers/gcp/gcp.go`:
- Around line 765-780: The project-scope enrichment currently only augments
entries and doesn't remove IDs that fail lookup, so update
projectScope.enrichWithProjectNumbers to filter out unresolved projects: iterate
ps.orderedIDs, call manager.Projects.Get(id).Context(ctx).Do(), skip entries
that return an error or have empty ProjectId, and build new slices/maps
(resolvedIDs, resolvedAllowedIDs, resolvedAllowedNumbers) and then assign them
back to ps.orderedIDs, ps.allowedIDs, ps.allowedNumbers; preserve recording the
first lookup error (firstErr) for reporting but do not retain failed IDs in the
scope so that listIDs() returns only resolved project IDs and the subsequent
empty-check works as intended.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 46cc71e6-3fb0-4da2-9fda-7b3abdac0c6b
📒 Files selected for processing (2)
pkg/providers/gcp/gcp.gopkg/providers/gcp/gcp_test.go
ehsandeep
approved these changes
Mar 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix GCP Organization Provider failing with
no projects available for organization discoverywhen the SA cannot list projects viacloudresourcemanager.Projects.List.Regression: Introduced in #719 (commit
334ae91), which added an unconditional empty-projects guard that blocked org-level Asset API discovery.Fix: Separate the two code paths:
project_ids→ strict validation, hard error if empty after resolutionProjects.Listfailure is a warning, provider falls back to org-level Asset API (organizations/{id}scope)Closes #738
Test plan
TestNewOrganizationProvider_NoProjectsListedFallsBackToOrgLevel— org-level path with no project listingTestNewOrganizationProvider_ConfiguredProjectsStillValidated— explicit project_ids still validatedTestSplitAndCleanProjectList/TestProjectScopeAllowsAsset*— existing tests passReference
🤖 Generated with Claude Code