feat(resource-policies): add statement evaluator - #6892
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
PR SummaryHigh Risk Overview Adds a required per-group policy lifecycle (create/delete/backfill), optimistic-concurrency admin GET/PUT, and a settings Access tab. Credential use now evaluates Threads current workflow (draft vs active deployment version) through executor delegation and child-workflow execution so workflow principals and Reviewed by Cursor Bugbot for commit a01a557. Bugbot is set up for automated code reviews on this repo. Configure here. |
9995853 to
0c9fb23
Compare
Greptile SummaryThe PR replaces credential-group grants with statement-based resource policies and carries persisted workflow authority into credential-use decisions.
Confidence Score: 5/5The PR appears safe to merge because no blocking failure remains within the eligible follow-up scope. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| apps/sim/lib/resource-policies/evaluator.ts | Adds generic statement evaluation with deny precedence, principal matching, condition evaluation, and implicit denial. |
| apps/sim/lib/credential-groups/application/workflow-access-policy.ts | Defines the bounded credential-group policy document and translates selected workflows into deployment-only access statements. |
| apps/sim/lib/credential-groups/application/authorization.ts | Replaces enrollment-only credential authorization with resource-policy evaluation using actor and current-workflow facts. |
| apps/sim/lib/workflows/executor/execution-core.ts | Carries draft or deployment-version workflow authority into executor delegation context. |
| apps/sim/lib/auth/internal-delegation.ts | Validates delegated current-workflow authority against durable root execution and deployment records. |
| apps/sim/ee/credential-groups/components/credential-group-access.tsx | Adds a revision-aware workflow-access editor with staged changes, conflict preservation, and save-time availability checks. |
| packages/db/credential-group-resource-policies.ts | Adds policy lifecycle-trigger installation, bounded batched reconciliation, idempotent insertion, and invariant validation. |
| packages/db/migrations/0309_material_blonde_phantom.sql | Introduces durable resource-policy storage with workspace ownership and per-resource uniqueness. |
| packages/db/script-migrations/0010_backfill_credential_group_resource_policies.ts | Registers the credential-group policy reconciliation as an ordered data migration. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
A[Workflow execution] --> B[Persisted principal and workflow authority]
B --> C[Credential resolution]
C --> D[Load credential-group resource policy]
D --> E[Evaluate principals and conditions]
E -->|Explicit allow| F[Return credential]
E -->|Explicit or implicit deny| G[Refuse credential use]
H[Workspace admin] --> I[Credential-group access editor]
I --> J[Update workflow policy statements]
J --> D
Reviews (15): Last reviewed commit: "feat(resource-policies): add credential ..." | Re-trigger Greptile
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
aaea6ae to
52e3168
Compare
95eafd9 to
9d5f513
Compare
c2d891e to
64f547f
Compare
64f547f to
eccb03a
Compare
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
3 issues from previous reviews remain unresolved.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit eccb03a. Configure here.
eccb03a to
ede2aba
Compare
|
@cursor review |
|
@cursor review |
|
Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings. |
1 similar comment
1 similar comment
1 similar comment
6c81bdc to
36308d6
Compare
36308d6 to
2695fa0
Compare
1 participant
Summary
Type of Change
Testing
Checklist