chore: update package.json and README for examples - #73
Conversation
- Added "packageManager" field to package.json for both root and examples directories to specify Yarn version. - Introduced a new "Examples" section in README.md to provide runnable demos and instructions for the examples directory. - Created .gitignore for examples to exclude unnecessary files. - Added docker-compose.sync.yml for setting up a local environment for examples. - Included multiple demo scripts and TypeScript configurations for various entitlement checks in the examples directory.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
- Refactored `SpiceDBEntitlementsClient` to enhance the handling of lookup entitlements results, ensuring that the number of returned entitlements does not exceed the requested limit. - Introduced a new method `limitLookupEntitlementsResults` to manage results more effectively and maintain clarity in the response structure. - Updated tests to verify that the entitlement lookup respects the specified limits and returns the correct cursor for pagination. - Cleaned up code formatting and improved readability across several files.
…nation - Improved the `SpiceDBEntitlementsClient` to better handle pagination and cursor management during entitlement lookups. - Introduced new types and interfaces for managing lookup streams and cursor states, ensuring consistent handling of tenant and user contexts. - Updated the `createTargetingCaveatContext` function to accept a `now` parameter for better time context management. - Enhanced tests to cover new pagination scenarios and ensure correct cursor behavior across multiple pages. - Cleaned up code formatting and improved readability throughout the affected files.
…xt management - Removed unused interfaces related to entitlements streaming from `spicedb-entitlements.client.ts` for cleaner code. - Updated `createTargetingCaveatContext` to ensure the `now` parameter is correctly integrated into the context structure. - Added a test case to verify that user attributes can override the generated `now` value, enhancing flexibility in context creation. - Introduced new types for entitlements streaming in `lookup.types.ts` to improve type safety and clarity in handling entitlements. - Cleaned up code formatting and improved overall readability across affected files.
- Enhanced the README.md to clarify setup instructions, including npm as an alternative to yarn. - Expanded the authorization model section with detailed schema overviews and relationship tuples. - Added a new diagram (`schema-relationships.png`) to visually represent the schema relationships for better understanding of the examples. - Updated the running examples section to reflect changes in demo script commands.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit add9d7d. Configure here.
| } | ||
| }; | ||
| return acc; | ||
| }, {}) |
There was a problem hiding this comment.
Attributes can silently override pinned pagination now value
Medium Severity
In createTargetingCaveatContext, the spread of attributes comes after the now field definition. Since later properties in an object literal override earlier ones with the same key, if attributes contains a key named now, it silently overrides the explicitly-pinned now parameter. The lookupEntitlements pagination relies on now being identical across pages (stored in the cursor), but a now attribute would break SpiceDB cursor stability since the caveat context would differ from what was used when the cursor was created.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit add9d7d. Configure here.
|
🎉 This PR is included in version 3.0.1-alpha.1 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
🎉 This PR is included in version 3.0.1 🎉 The release is available on: Your semantic-release bot 📦🚀 |
3 participants
Note
Medium Risk
New authorization listing and pagination logic can affect which features callers see; behavior is covered by tests but dual-stream cursors need careful client handling when aggregating pages.
Overview
Adds
lookupEntitlementsso callers can list effective feature grants for a tenant-only subject or a tenant+user subject (tenant stream plus user stream, merged and deduped per page). User lookups verify tenant membership first; non-members get an empty result. Pagination uses a composite encoded cursor (per-stream SpiceDB tokens plus a pinnednowfor targeting caveats) with extensive unit tests.Supporting changes: shared
createTargetingCaveatContext, request/response mappers and types, and README Lookup Entitlements / Examples sections.Also ships a standalone
examples/workspace (Docker/SpiceDB schema, demo scripts forisEntitledTo, FGA lookups, andlookupEntitlements) and pinspackageManagerto Yarn 1.22.22 on root and examplespackage.json.Reviewed by Cursor Bugbot for commit add9d7d. Bugbot is set up for automated code reviews on this repo. Configure here.