Repository navigation
Conversation
c6391e8 to
ea3d391
Compare
1af2768 to
09b12fe
Compare
|
|
574efbb to
3d26a9c
Compare
4f5a9fd to
3fada80
Compare
8254557 to
ba78d30
Compare
swkeever
left a comment
swkeever
left a comment
There was a problem hiding this comment.
[P2] Update the pinned contract SHA alongside this sync. Both required Ruby suites fail the bundled-contract assertion in spec/volcano_generation_spec.rb: expected d8d8f53d847bfdc31c6a9aa5d583a8541f67be3a52b79cd754163660d001a9a8, actual 90f23da23d78af8e2be84044333b891f5f58ed29638146c620cd9cb67fde4d9c. The new snapshot matches Hosting 111313e148bad1bbd3537a509b357e6d1abdaa0c/api/openapi.bundled.yaml. Update the fixture after validating that contract and rerun bundle exec rake quality. This failure also prevents the later injected-defect and package smoke checks from running.
CI evidence: https://github.com/Kong/volcano-sdk-ruby/actions/runs/38667886847/job/116203898115
tkkhq
left a comment
tkkhq
left a comment
There was a problem hiding this comment.
The non-blocking checksum defect in the existing review remains: spec/volcano_generation_spec.rb:10,52 expects d8d8f53d847bfdc31c6a9aa5d583a8541f67be3a52b79cd754163660d001a9a8, while the vendored contract hashes to 90f23da23d78af8e2be84044333b891f5f58ed29638146c620cd9cb67fde4d9c. Update the expected digest and pass bundle exec rake quality before merge; the Ruby suites and Quality Gate still fail.
AI review: 2 P0-P2 finding(s)An automated re-sync of the vendored OpenAPI contract from Kong/volcano-hosting@77bcad0c49a2, which regenerates about 285 files of the private 🟠 P1
🟡 P2
⚪ P3
🟣 Pre-existing
Not checked: The AI review read the diff, the code, and the PR's text; it ran no tests or builds and read nothing outside this repository.
Push a fix, or have a collaborator with write access (including the PR author) add the 16 rounds in a row have found P0-P2 problems since this PR was last marked ready for review, so the AI review asks the author to re-assess the approach. Human review: needed
Decide the points above: approve to accept them, or request changes. Suggested reviewer: |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| class DurableMessageDirection | ||
| IN = "in".freeze | ||
| OUT = "out".freeze | ||
| DurableMessageDirectionIn = "in".freeze |
There was a problem hiding this comment.
⚪ P3: Generated DurableMessageDirection::IN/OUT renamed to DurableMessageDirectionIn/DurableMessageDirectionOut
The upstream contract added Go-style x-enum-varnames, and the Ruby generator uses them as constant names. As a result, Volcano::Generated::DurableMessageDirection::IN and ::OUT disappear and are replaced by the repetitive DurableMessageDirection::DurableMessageDirectionIn and ::DurableMessageDirectionOut. The new autofix enums get the same style (e.g. AutofixRunStatus::AutofixRunStatusQueued). The handwritten facade compares plain 'in'/'out' strings (lib/volcano/durable_messages.rb, lib/volcano/durable_message_stream.rb), so nothing in this repo breaks. CONTRIBUTING.md and docs/versions.md also treat Volcano::Generated as internal. Still, the namespace ships in the gem, so any consumer that referenced the old constants gets NameError after upgrading, and the commit is typed chore so no breaking change is announced. If the old names matter, map them back with the generator's native enum-name mapping configuration in openapi-generator.yaml rather than editing generated code.
Found by claude-opus-5-5
| if attributes.key?(:'status') | ||
| self.status = attributes[:'status'] | ||
| else | ||
| self.status = STATUS::N308 |
There was a problem hiding this comment.
⚪ P3: New redirect models default status to undefined constant STATUS::N308, raising NameError
FrontendCustomDomainRedirectRequest#initialize (and ProjectConfigCustomDomainRedirect#initialize at line 102 of project_config_custom_domain_redirect.rb) assign self.status = STATUS::N308 when status is omitted, but no STATUS constant is defined anywhere in the generated client. Building either model without status — e.g. FrontendCustomDomainRedirectRequest.new(to: 'www.example.com'), or deserializing a GET /projects/{id}/config response whose custom_domains[].redirect omits status — raises NameError: uninitialized constant ...::STATUS. Nothing in the facade reaches these models today (FrontendsApi/ProjectsApi are not in GeneratedApis, and Volcano::Generated is private), so this only bites once a facade wraps custom-domain redirects or project config. The same pattern already exists in CreateSandboxTemplateRequest (MEMORY_MB::N1024). The repo owns openapi/templates/partial_model_generic.mustache, which renders {{{defaultValue}}} verbatim; emitting the literal value for inline integer enums there would fix all three.
Found by claude-opus-5-5
| if attributes.key?(:'status') | ||
| self.status = attributes[:'status'] | ||
| else | ||
| self.status = STATUS::N308 |
There was a problem hiding this comment.
🟡 P2: Generate a valid integer default for redirect status
Constructing FrontendCustomDomainRedirectRequest.new(to: 'www.example.com') raises NameError: STATUS::N308 is undefined, although the contract permits omitting status and promises a default of 308. ProjectConfigCustomDomainRedirect has the same defect at line 102, breaking deserialization of redirects that omit status. Fix default generation and regenerate both models so the default is the integer 308.
Found by gpt-6.1-sol
| @@ -35,6 +35,8 @@ tags: | |||
| a start returns is an execution to poll and stop, not a result. Durable | |||
| work is metered on its own allowances: executions, and the operations each | |||
| execution performs while it runs. | |||
| - name: Notifications | |||
There was a problem hiding this comment.
🟠 P1: Update the pinned contract digest with the sync
The changed contract hashes to f98942216d85196297a3c17292e5d0beb4e7a72900528835ed9f3593a702207a, but spec/volcano_generation_spec.rb:10 still pins the base digest. Its assertion at line 52 therefore fails deterministically in both CI Ruby jobs through rake quality. Update the expected digest alongside the contract.
Found by gpt-6.1-sol
| if attributes.key?(:'status') | ||
| self.status = attributes[:'status'] | ||
| else | ||
| self.status = STATUS::N308 |
There was a problem hiding this comment.
⚪ P3: New redirect models default status to an undefined STATUS::N308 constant
ProjectConfigCustomDomainRedirect#initialize (line 102) and FrontendCustomDomainRedirectRequest#initialize (frontend_custom_domain_redirect_request.rb:104) set self.status = STATUS::N308 when status is omitted. Neither class defines STATUS, so this raises NameError.
The contract makes status optional with a default of 308. That means a GET /projects/{id}/config response, or a hand-built request, with a redirect but no status would crash in the generated client instead of defaulting.
The generator already does this for integer-enum defaults: the base has MEMORY_MB::N1024 in create_sandbox_template_request.rb. Nothing in the SDK reaches these models today, because Volcano::Generated is private and the contract says a redirect can't exist while a frontend holds one domain. Anyone who later wraps custom-domain redirects should either set status explicitly or fix the generator template or mapping.
Found by claude-opus-5-5
| @@ -35,6 +35,8 @@ tags: | |||
| a start returns is an execution to poll and stop, not a result. Durable | |||
| work is metered on its own allowances: executions, and the operations each | |||
| execution performs while it runs. | |||
| - name: Notifications | |||
There was a problem hiding this comment.
🟠 P1: Pinned openapi_sha256 in spec/volcano_generation_spec.rb not updated for the re-synced contract
spec/volcano_generation_spec.rb:10 still pins 7fec2090…def8, the base contract's digest. This PR rewrites openapi/openapi.yaml, so its SHA-256 no longer matches. The check expect(Digest::SHA256.file(...openapi.yaml).hexdigest).to eq(openapi_sha256) at line 52 therefore fails every time. That fails quality:spec, and with it rake quality on both CI Ruby jobs. Merging as-is would turn main red. Fix: update openapi_sha256 to the new file's digest in the same commit as the sync, and ideally have the sync automation do this too.
Found by claude-opus-5-5
| class DurableMessageDirection | ||
| IN = "in".freeze | ||
| OUT = "out".freeze | ||
| DurableMessageDirectionIn = "in".freeze |
There was a problem hiding this comment.
⚪ P3: Preserve concise Ruby direction enum names
The new x-enum-varnames replace IN and OUT with repetitive names such as DurableMessageDirection::DurableMessageDirectionIn without changing wire values. The facade uses strings and Volcano::Generated is private, so this is a low-impact generation and naming concern. Consider retaining the shorter Ruby names through generator configuration.
Found by gpt-6.1-sol
| if attributes.key?(:'provider_user_id') | ||
| self.provider_user_id = attributes[:'provider_user_id'] | ||
| else | ||
| self.provider_user_id = nil |
There was a problem hiding this comment.
🟡 P2: Listing linked OAuth providers raises a bare ArgumentError when an entry lacks the new provider_user_id
The regenerated model now requires provider, provider_user_id, linked_at and updated_at. Its setters raise ArgumentError on nil (lines 150–186); base checked none of these.
auth_list_oauth_providers (lib/volcano/generated_transport_oauth.rb:36) passes no debug_return_type, so every entry goes through this model. GeneratedTransport#invoke rescues only Generated::ApiError, so the error escapes.
Effects:
- An entry without
provider_user_idcrashesclient.auth.list_linked_oauth_providers. It could come from an older or local server, or from rows linked before Hosting stored the ID. The facade never reads that field. - Malformed entries now raise
ArgumentError, not the documentedTypeError, 'Expected complete linked OAuth providers'(lib/volcano/auth_oauth.rb:63-86).
The specs miss this: spec/support/generated_api/fake_o_auth_api.rb:35-47 returns a fake model without provider_user_id, skipping the generated model.
Fix: rescue that ArgumentError on this path and map it to the existing TypeError, or request the raw body and parse the timestamps in the facade. Add a spec that deserializes through the real generated model.
Found by claude-opus-5-5
| if attributes.key?(:'provider_user_id') | ||
| self.provider_user_id = attributes[:'provider_user_id'] | ||
| else | ||
| self.provider_user_id = nil |
There was a problem hiding this comment.
🟡 P2: Preserve linked-provider responses without the new account ID
A response containing provider, linked_at, and updated_at, valid under the previous contract, now raises ArgumentError when provider_user_id is absent. GeneratedTransport#auth_list_oauth_providers uses this model, and invoke does not rescue that exception, so client.auth.list_linked_oauth_providers fails before the facade validates the response. Keep unused new metadata optional in the consumer boundary and preserve the facade’s existing error handling.
Found by gpt-6.1-sol
| @@ -23,8 +23,8 @@ tags: | |||
| description: Project-scoped log search and activity APIs | |||
| - name: Issues | |||
| description: 'Preview, not generally available: runtime errors grouped into issues. Where issues are not available, every endpoint answers `404` with code `feature_unavailable`.' | |||
| - name: Autofix | |||
| description: 'Preview, not generally available: AI diagnosis of a project''s issues and draft pull requests that fix them. Where autofix is not available, turning it on, or any request for a project that never saved settings, answers `404` with code `feature_unavailable`. Autofix is not available in local mode.' | |||
| - name: LavaFlow | |||
There was a problem hiding this comment.
🟠 P1: Update the pinned contract digest alongside the sync
The head contract hashes to ea8d99dbea0dd8ca7edcb794a0c3332a6981e67d31dae52f9ba14cce2260864c, but spec/volcano_generation_spec.rb:10 still expects the base digest, 168cf780…1bf340. Its assertion at line 52 therefore fails deterministically, failing quality:spec and both CI Ruby jobs. Update the expected digest with this sync.
Found by gpt-6.1-sol
| @@ -23,8 +23,8 @@ tags: | |||
| description: Project-scoped log search and activity APIs | |||
| - name: Issues | |||
| description: 'Preview, not generally available: runtime errors grouped into issues. Where issues are not available, every endpoint answers `404` with code `feature_unavailable`.' | |||
| - name: Autofix | |||
| description: 'Preview, not generally available: AI diagnosis of a project''s issues and draft pull requests that fix them. Where autofix is not available, turning it on, or any request for a project that never saved settings, answers `404` with code `feature_unavailable`. Autofix is not available in local mode.' | |||
| - name: LavaFlow | |||
There was a problem hiding this comment.
🟠 P1: Contract re-synced without updating the pinned SHA-256 in spec/volcano_generation_spec.rb
spec/volcano_generation_spec.rb:10 still pins 168cf780648fdb7878275bd8e596091341a90bed137e7871e546fbf11b1bf340, and this PR does not touch that file. It does rewrite openapi/openapi.yaml, so the file's digest changes. The digest assertion at line 52 therefore fails every time. That fails quality:spec and rake quality in CI, and merging as-is turns main red. Fix: update openapi_sha256 to the new file's digest in the same commit as the sync. Ideally the sync automation would also rewrite the pin.
Found by claude-opus-5-5
| if attributes.key?(:'status') | ||
| self.status = attributes[:'status'] | ||
| else | ||
| self.status = STATUS::N308 |
There was a problem hiding this comment.
⚪ P3: Generate a defined default for redirect status
Constructing FrontendCustomDomainRedirectRequest.new(to: 'www.example.com') raises NameError because STATUS::N308 is undefined, although the schema permits omitted status and defaults it to 308. ProjectConfigCustomDomainRedirect:102 has the same defect. These APIs are currently outside the public facade, limiting the impact to the internal generated client. Correct default generation to emit integer 308 and regenerate both models.
Found by gpt-6.1-sol
AI review: re-assess the approachPR author, the AI review has found P0-P2 problems in 3 rounds in a row, through 713b74d, since this PR was last marked ready for review. When each fix brings new findings, the approach is usually the problem rather than the next fix, but the AI review could not move this PR back to draft, so it keeps reviewing each push. Convert the PR to draft yourself while you decide how to go on. Consider:
Coding agents: stop here and do not push another fix for these findings. Tell the author this PR did not converge after 3 AI review rounds, summarize the open findings and where they cluster, recommend one of the options above, and wait for the author's decision before changing the code or marking the PR ready for review. Marking the PR ready for review starts a new set of 3 rounds with a review of the current head. To accept the findings as they stand, mark it ready, and once that review finishes, add the |
AI review: re-assess the approachPR author, the AI review has found P0-P2 problems in 16 rounds in a row, through 54d4c7a, since this PR was last marked ready for review. When each fix brings new findings, the approach is usually the problem rather than the next fix, so the AI review moved this PR back to draft, where it reviews no pushes, until you decide how to go on. Consider:
Coding agents: stop here and do not push another fix for these findings. Tell the author this PR did not converge after 16 AI review rounds, summarize the open findings and where they cluster, recommend one of the options above, and wait for the author's decision before changing the code or marking the PR ready for review. Marking the PR ready for review starts a new set of 3 rounds with a review of the current head. To accept the findings as they stand, mark it ready, and once that review finishes, add the |
Summary
API change report
Public API
New Endpoints: 87
GET /connectors
POST /connectors
DELETE /connectors/{connector_id}
GET /connectors/{connector_id}
POST /durable-callbacks
POST /durable-callbacks/fail
POST /durable-callbacks/heartbeat
POST /durable-callbacks/succeed
POST /forks
POST /issues
GET /lavaflow/connector-bindings
POST /lavaflow/connector-bindings
DELETE /lavaflow/connector-bindings/{binding_id}
POST /lavaflow/held-fix-opens
GET /lavaflow/resources
GET /lavaflow/runs
POST /lavaflow/runs
GET /lavaflow/runs/{run_id}
GET /lavaflow/scans
GET /lavaflow/settings
PATCH /lavaflow/settings
GET /lavaflow/stats
GET /projects/{id}/capabilities
GET /projects/{id}/databases/{databaseName}/migration-runs
POST /projects/{id}/databases/{databaseName}/migration-runs
GET /projects/{id}/databases/{databaseName}/migration-runs/{runId}
GET /projects/{id}/databases/{databaseName}/migrations
POST /projects/{id}/databases/{databaseName}/migrations/baseline
GET /projects/{id}/frontends/{frontendId}/candidates
POST /projects/{id}/frontends/{frontendId}/candidates
DELETE /projects/{id}/frontends/{frontendId}/candidates/{candidateId}
GET /projects/{id}/frontends/{frontendId}/candidates/{candidateId}
POST /projects/{id}/frontends/{frontendId}/candidates/{candidateId}/deployments
POST /projects/{id}/frontends/{frontendId}/candidates/{candidateId}/promote
POST /projects/{id}/frontends/{frontendId}/deployments
GET /projects/{id}/frontends/{frontendId}/domains
POST /projects/{id}/frontends/{frontendId}/domains
DELETE /projects/{id}/frontends/{frontendId}/domains/{domain}
GET /projects/{id}/frontends/{frontendId}/domains/{domain}
PATCH /projects/{id}/frontends/{frontendId}/domains/{domain}
GET /projects/{id}/frontends/{frontendId}/frontend-routes
POST /projects/{id}/frontends/{frontendId}/frontend-routes
DELETE /projects/{id}/frontends/{frontendId}/frontend-routes/{routeId}
PUT /projects/{id}/frontends/{frontendId}/frontend-routes/{routeId}
GET /projects/{id}/frontends/{frontendId}/serving
POST /projects/{id}/frontends/{frontendId}/serving/rollback
GET /projects/{id}/functions/{functionId}/candidates
POST /projects/{id}/functions/{functionId}/candidates
DELETE /projects/{id}/functions/{functionId}/candidates/{candidateId}
GET /projects/{id}/functions/{functionId}/candidates/{candidateId}
GET /projects/{id}/functions/{functionId}/candidates/{candidateId}/deployments
POST /projects/{id}/functions/{functionId}/candidates/{candidateId}/deployments
POST /projects/{id}/functions/{functionId}/candidates/{candidateId}/promote
GET /projects/{id}/functions/{functionId}/serving
POST /projects/{id}/functions/{functionId}/serving/rollback
GET /projects/{id}/git-connection/owner-push
PUT /projects/{id}/git-connection/root-directory
GET /projects/{id}/git-deployment-runs
GET /projects/{id}/git-deployment-runs/{runId}
GET /projects/{id}/notifications
PUT /projects/{id}/notifications
POST /projects/{id}/notifications/test
POST /projects/{id}/notifications/webhook-secret
POST /realtime/v1/publish
POST /sandbox-file-archives
POST /sandbox-file-parts
GET /sandbox-session-files
GET /share-previews/{share_id}
GET /share-release-drafts
GET /share-releases
POST /share-releases
GET /share-stats
GET /shares
POST /shares
DELETE /shares/{share_id}
GET /shares/{share_id}
PATCH /shares/{share_id}
GET /slack/callback
DELETE /user/sessions
GET /user/sessions
DELETE /user/sessions/{sessionId}
GET /user/slack/channels
GET /user/slack/connections
POST /user/slack/connections
DELETE /user/slack/connections/{connectionId}
POST /user/slack/installations
DELETE /user/tokens/current
Deleted Endpoints: 3
GET /projects/{id}/autofix
PUT /projects/{id}/autofix
DELETE /projects/{id}/autofix/api-key
Modified Endpoints: 268
POST /auth/device/token
access_denied- the approving account's email domain is not inallowed_email_domainswhileallowed_email_domains_modeissignup_and_signin. Re-checked here because approval and redemptionare separate requests.
' to '
access_denied- the approving account's canonical email, or the emailof any of its identities, is not in
allowed_email_domainswhileallowed_email_domains_modeissignup_and_signin. Re-checked here because approval and redemptionare separate requests.
'
POST /auth/device/verify
plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'POST /auth/forgot-password
plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'POST /auth/logout
POST /auth/oauth/exchange
in
allowed_email_domainswhileallowed_email_domains_modeissignup_and_signin. Both are re-checked here because the code outlivesthe callback that issued it.
' to 'Email confirmation is now required, or the account's canonical email or
the provider identity's email is not in
allowed_email_domainswhileallowed_email_domains_modeissignup_and_signin. Both are re-checked here because the code outlivesthe callback that issued it.
'
GET /auth/oauth/providers
user's own account ID at each provider. Match on
provider_user_id,which never changes, rather than on the login or email. For
GitHub, it is the numeric user ID that GitHub reports elsewhere, such
as a webhook's
sender.id.'
plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'POST /auth/oauth/{provider}/call-api
plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'GET /auth/oauth/{provider}/callback
flow's stored redirect_url is no longer registered in
allowed_redirect_urls (re-checked at callback time)
' to 'Missing/invalid code or state, the state parameter expired, the
provider was disabled after the flow started, or the flow's stored
redirect_url is no longer registered in allowed_redirect_urls (both
re-checked at callback time)
'
allowed_email_domains. Creatingan account is refused under
signupandsignup_and_signin; signing inan already-linked account is refused under
signup_and_signin.' to 'The provider's email domain is not in
allowed_email_domains. Creatingan account is refused under
signupandsignup_and_signin; signing inan already-linked account is refused under
signup_and_signin, as it iswhen the account's canonical email is outside the list. A new account
at a reserved domain (
anonymous.volcano.internal,volcano.local) isrefused whatever the project allows.
'
POST /auth/oauth/{provider}/link
plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'POST /auth/oauth/{provider}/refresh-token
plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'GET /auth/oauth/{provider}/token
plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'DELETE /auth/oauth/{provider}/unlink
Cannot unlink if it's the only authentication method.
' to 'Remove OAuth provider from user's account. Refused when the account would
have no other way to sign in: another linked OAuth provider that's enabled
for the project, or a password while email/password sign-in is on for the
project (
enable_email_password).'
plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'GET /auth/password-policy
plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'POST /auth/platform/exchange
account's email domain is not in
allowed_email_domainswhileallowed_email_domains_modeissignup_and_signin. The domain isre-checked here because the minted platform token outlives the
session it is exchanged from.
' to 'Exchange not allowed for this session/client/project, or the
account's canonical email, or the email of any of its identities, is
not in
allowed_email_domainswhileallowed_email_domains_modeissignup_and_signin. The domain is re-checked here because the minted platform token outlives thesession it is exchanged from.
'
plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'POST /auth/refresh
plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'allowed_email_domainswhileallowed_email_domains_modeissignup_and_signin, so the sessioncannot be extended
' to 'The account's canonical email, or the email of the identity the
session signed in with, is not in
allowed_email_domainswhileallowed_email_domains_modeissignup_and_signin, so the sessioncannot be extended
'
plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'POST /auth/resend-confirmation
plan_required(403) means the project owner's plan does not include the requested feature or option; upgrading the plan unlocks it.person_required(403) means a project access token tried to change LavaFlow settings, which only the project's owner changes, with a platform token, or that the change needs the owner's own credential that expires, a project repository, and an owner whose GitHub account can push to it;errorsays which. A 403 without a code leaves the reason unspecified: it can be an access refusal, a reached limit, or a plan check that could not read the owner's plan. Match on the code, not the message text.'POST /auth/reset-password
Report truncated; see the source commit for the complete contract diff.
Validation