Repository navigation
Upgrade notes: a request naming the role reader gets the built-in one - #827
Merged
Merged
Conversation
Migration 0013 renames an administrator's role `reader` to `reader-<id>`
and creates the built-in `reader`, which reads every repository. The admin
API resolves a role given by name at request time, so a 2.1 script that
assigns `{"role": "reader"}` now gives its accounts read on every
repository without an error. Say so in the 2.2.0 upgrade notes, with the
409 a script creating the role now meets, and how to find the renamed
role.
Fixes #822
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012e6DJbzZtA6Cmowfnd4LLw
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #822
Migration 0013 renames a role that an administrator named
readertoreader-<id>, then creates the built-inreader, which reads every repository. The admin API resolves a role given by name at request time (resolve_role_idincrates/server/src/admin/user_roles.rs→authz_dao::role_id_by_name). So a 2.1 script that sendsPUT /admin/users/{id}/roles {"role": "reader"}now gives its accounts read on every repository, and the request succeeds.733.upgrade.mdcovers the rename but not this effect.This adds
docs/changes/2.2.0/822.upgrade.md. The note says:readergets the built-in role. This includes a script that looks the id up by name inGET /admin/roles.POST /admin/roleswith the namereadernow answers 409. A script that reads that 409 as "the role exists" then goes on with the built-in role.role_id, which the upgrade keeps. After it, namereader-<id>instead.GET /admin/rolesor Admin → Roles.The other role-by-name lookups don't need a note:
POST /admin/users, OIDC and trusted-header sign-ups) asks for the built-in role on purpose.readerrole at the built-inreader, which reads every repository #749, which already has its own note.Docs only; no code changes. #822 moved from milestone 2.3.0 to 2.2.0 and carries
release blocker.Checks
cargo xtask changelog --check: 54 fragments, all for milestones after 2.1.0.Generated by Claude Code