add internal list-permissions endpoint - #596
Conversation
🦋 Changeset detectedLatest commit: 12fc774 The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 233309f. Configure here.
| * Session ids among `ids` owned by `subject_id`. Empty `ids` → `[]`. | ||
| * Does **not** bump `last_activity_timestamp_ms`. | ||
| */ | ||
| getOwnedIds(input: GetOwnedIdsInput): Promise<readonly string[]>; |
There was a problem hiding this comment.
Store methods lack contract tests
Medium Severity
getOwnedIds was added to ISessionStore and every backend, but storeContractSuite.ts was not updated. The same gap exists for IAgentStore.getOwnedIds / getExternalIdsByIds and IScheduleStore.getOwnedIds. Shared contract coverage is what checks tenant scoping, empty ids, owner matching, and the Postgres ->> versus SQLite json_extract paths.
Additional Locations (2)
Triggered by project rule: @truefoundry/trueforge-core review rules
Reviewed by Cursor Bugbot for commit 233309f. Configure here.
There was a problem hiding this comment.
Will add these later
| data[id] = [...OWNER_RESOURCE_PERMISSIONS]; | ||
| } | ||
| return data; | ||
| } |
There was a problem hiding this comment.
Admins denied schedule permissions
Medium Severity
getPermissions grants MANAGE and DELETE on schedules only when created_by_subject.subject_id matches the caller. Schedule routes already treat hasAdminRole as full access, so an OIDC admin receives empty grants for schedules they can still update or delete.
Additional Locations (1)
Triggered by learned rule: Schedule RBAC is creator-or-admin; 403 vs 404
Reviewed by Cursor Bugbot for commit 233309f. Configure here.
| summary: 'List permissions for resources', | ||
| description: 'Return granted actions (MANAGE, DELETE) for each requested agent, schedule, or session id.', | ||
| 'x-fern-sdk-group-name': ['internal'], | ||
| 'x-fern-sdk-method-name': 'list_permissions', |
There was a problem hiding this comment.
Internal path is not a collection
Low Severity
The new route is POST /api/internal/list-permissions with Fern group internal and method list_permissions. Internal paths are /api/internal/{collection} (plural kebab), matching /api/internal/sessions and /api/internal/metrics. A verb in the path also freezes a non-collection SDK shape once generated.
Additional Locations (1)
Triggered by project rule: @truefoundry/trueforge review rules
Reviewed by Cursor Bugbot for commit 233309f. Configure here.
1 participant
Summary
add internal list-permissions endpoint
Closes AGE-2093
Changes
add internal list-permissions endpoint
How was this tested?
Manually calling the endpoints
Checklist
pnpm build,pnpm test,pnpm typecheck,pnpm lint:ci, andpnpm format:checkpass locallypackages/trueforge-sdk,.github/fern/openapi/openapi.json,docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge.env.exampleupdated if configuration or behavior changedNote
Medium Risk
Introduces new authorization surface area and TrueFoundry agent permission mapping; incorrect grants could mislead UIs or callers about who can manage or delete resources.
Overview
Adds POST
/api/internal/list-permissionsso callers can resolve MANAGE and DELETE grants for up to 100 ids at once for agents, schedules, or sessions. The response is a map keyed by resource id; ids the caller cannot access (or that do not exist) return[].The handler wires through
Authorizer.getPermissions, with new store helpersgetOwnedIds(andgetExternalIdsByIdsfor agents) to bulk-load ownership instead of per-id checks. Standalone/OIDC grants full owner permissions whencreated_by_subjectmatches the caller. TrueFoundry agents are evaluated via ServiceFoundryMANAGE_AGENTon linkedexternal_ids; schedules and sessions still use local ownership.OpenAPI, Fern-generated SDK (
client.internal.listPermissions), and a minor bump in trueforge / trueforge-core are included.Reviewed by Cursor Bugbot for commit 12fc774. Bugbot is set up for automated code reviews on this repo. Configure here.