FR-26219 Make spiceClient private - #80
Closed
dianaKhortiuk-frontegg wants to merge 2 commits into
Closed
Conversation
dianaKhortiuk-frontegg
force-pushed
the
fr-26219-sdk-hardening
branch
from
September 9, 2026 11:09
582cae4 to
0f0dcdd
Compare
dianaKhortiuk-frontegg
force-pushed
the
fr-26219-sdk-private-spice-client
branch
from
September 9, 2026 11:09
7a807a1 to
5543994
Compare
This was referenced Sep 9, 2026
dianaKhortiuk-frontegg
force-pushed
the
fr-26219-sdk-hardening
branch
from
September 9, 2026 11:45
0f0dcdd to
9999b50
Compare
dianaKhortiuk-frontegg
force-pushed
the
fr-26219-sdk-private-spice-client
branch
from
September 9, 2026 11:45
5543994 to
8371bc3
Compare
dianaKhortiuk-frontegg
force-pushed
the
fr-26219-sdk-hardening
branch
from
September 9, 2026 11:51
9999b50 to
b2a0d0d
Compare
dianaKhortiuk-frontegg
force-pushed
the
fr-26219-sdk-private-spice-client
branch
from
September 9, 2026 11:51
8371bc3 to
ee9d9aa
Compare
dianaKhortiuk-frontegg
force-pushed
the
fr-26219-sdk-hardening
branch
from
September 9, 2026 12:19
b2a0d0d to
d60f38f
Compare
dianaKhortiuk-frontegg
force-pushed
the
fr-26219-sdk-private-spice-client
branch
from
September 9, 2026 12:19
ee9d9aa to
0728917
Compare
dianaKhortiuk-frontegg
force-pushed
the
fr-26219-sdk-hardening
branch
from
September 9, 2026 14:53
d60f38f to
7d6b725
Compare
dianaKhortiuk-frontegg
force-pushed
the
fr-26219-sdk-private-spice-client
branch
from
September 9, 2026 14:53
0728917 to
4ee3ed6
Compare
Answers the "we prefer not using regex, hard to debug" comments on #78. The spec-level guard matched object-type fields by regex over source text, so it could only ever approximate the thing it was checking. The rule is type-aware instead: it flags an object-type field whose contextual type comes from @authzed/authzed-node and is not built through namespace.type(). Named for what it enforces, matching SchemaNamespace.
BREAKING CHANGE: spiceClient is no longer public. Direct access bypasses instance namespacing and can read another instance's data, which is why it carried @deprecated. Use isEntitledTo, the lookup methods, or readSchemaFor with an instanceId instead. Kept as its own change so removing a public field is a decision a reader can see, rather than a side effect of an unrelated refactor.
dianaKhortiuk-frontegg
force-pushed
the
fr-26219-sdk-hardening
branch
from
September 9, 2026 15:00
7d6b725 to
46ce1f7
Compare
dianaKhortiuk-frontegg
force-pushed
the
fr-26219-sdk-private-spice-client
branch
from
September 9, 2026 15:00
4ee3ed6 to
a9a01da
Compare
dianaKhortiuk-frontegg
force-pushed
the
fr-26219-sdk-hardening
branch
from
September 10, 2026 10:12
46ce1f7 to
d6f9b7c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Folded into #81 — a one-line PR cost more to track than it saved.
The change is unchanged:
spiceClientbecomes private, and the@deprecatednote goes with it since a private field can't be deprecated for callers who can no longer reach it. It's now the last commit onfr-26219-sdk-namespaced-reads(370be48), and #81's description records the breaking change.