Repository navigation
action: commit has no admin bypass (one authorization rule) - #1557
Conversation
An actor with the admin role passed every role-gated action through ActionInvocation::commit, while commit_via, the ClassRbac path, has no bypass. Two paths, two meanings of authorized. Admin is now an ordinary role on both: it passes only where an action requires it, and an admin who needs another action holds that action's role. No caller relied on the bypass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Warning Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 17bbbcc116
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
#1557 made admin an ordinary role in ActionInvocation::commit; the public guide still told consumers an admin satisfies any required_role. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg
2 participants
What
ActionInvocation::commitno longer lets an actor with theadminrole pass an action that requires a different role.Why
commit_via, theClassRbacpath, never had this bypass. With it, the two commit paths meant two different things by "authorized". Admin is now an ordinary role on both paths: it passes only where an action requiresadmin. An admin who needs another action holds that action's role, so admin power is visible in the grants.The change is policy only: no new mechanism, no reasoning added.
Callers
graph-flow-action::dispatchcallscommit. Its tests use no admin role, and no caller found relies on the bypass.ActorContext::is_adminitself is unchanged.Tests
action::tests::commit_admin_is_a_role_not_a_bypass:adminwithout the required role →Failed. This assertion failed before the change.adminplus the required role →Committed.Local gates:
clippy -D warningson the contract, all contract tests pass (1,475 lib tests).🤖 Generated with Claude Code
https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg
Generated by Claude Code