fix(admin-export): never emit raw $-prefixed role in License type column (CSA-449)#2569
Open
bladata1990 wants to merge 2 commits into
Open
fix(admin-export): never emit raw $-prefixed role in License type column (CSA-449)#2569bladata1990 wants to merge 2 commits into
bladata1990 wants to merge 2 commits into
Conversation
…umn (CSA-449)
The Users export preferred assignedRole.description (display name, e.g.
"Guest") but its elvis fallback was workspaceRole, which is the raw
"$"-prefixed system identifier (e.g. "$guest"). Whenever assignedRole was
null or its description was null/blank, the "License type" column leaked
"$guest"/"$admin"/"$member" instead of the human-readable name.
Extract resolution into a testable Users.licenseTypeOf() with a 4-step
fallback that humanizes the system identifier ("$guest" -> "Guest") so a
"$"-prefixed value is never written, regardless of which fields the
IAM/Heracles response populates. Add LicenseTypeTest covering all paths.
ci(temp): add this branch to the merge.yml push trigger and set
fail-fast:false on custom-package-images to build a snapshot image for
test-tenant validation. Revert before raising the PR.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: bladata1990 <balakrishnan.r@atlan.com>
Reverts the push-trigger branch entry and fail-fast:false added for snapshot image testing. merge.yml now matches main. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: bladata1990 <balakrishnan.r@atlan.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Users export's
License typecolumn showed the raw system identifier$guest(also$admin/$member) for some users instead of the display nameGuest.Root cause in
Users.kt: the column preferredassignedRole.descriptionbut its elvis fallback wasworkspaceRole, which is the$-prefixed system identifier. Any user with a null/blankassignedRole.description(e.g.assignedRolenull entirely) leaked the raw value.Fix
Extracted resolution into a testable
Users.licenseTypeOf()with a 4-step fallback that humanizes the system identifier ($guest→Guest), so a$-prefixed value is never written regardless of which fields the IAM/Heracles response populates. AddedLicenseTypeTest(7 cases) covering every path.Verification (fs3 /
cusucwap01)ghcr.io/atlanhq/csa-admin-export:7.2.4-SNAPSHOTto fs3, ran from Argo (Succeeded)demo-disabled-training(assignedRole=null,workspaceRole=$guest) now exportsGuestin theLicense typecolumn (was$guest); the other 136 users resolve viadescriptionas before — no regression.Closes CSA-449.
🤖 Generated with Claude Code