Skip to content

docs: remove reference to merged upstream json-patch PR in jsonx#1275

Open
telegraphchi wants to merge 2 commits into
ory:masterfrom
telegraphchi:fix/jsonx-stale-json-patch-reference
Open

docs: remove reference to merged upstream json-patch PR in jsonx#1275
telegraphchi wants to merge 2 commits into
ory:masterfrom
telegraphchi:fix/jsonx-stale-json-patch-reference

Conversation

@telegraphchi

@telegraphchi telegraphchi commented Jun 17, 2026

Copy link
Copy Markdown

What

Replace the stale upstream reference in oryx/jsonx/patch.go flagged by #1254.

Why

The comment pointed to evanphx/json-patch#158, which has since been merged. ORY's Closed Reference Notifier flags merged and closed PRs alike, so it was reported as a stale reference (#1254).

How

Replace the link with a durable description of the actual behaviour: only add, remove, and replace operations are accepted; move, copy, and test are intentionally rejected (matching opAllowList). This is a comment-only change — no behaviour change.

gofmt and go vet ./jsonx/ are clean; the package compiles.

Closes #1254

Summary by CodeRabbit

  • Documentation
    • Added clarification comments for JSON patch handling, explicitly stating which patch operations are supported (and that others are intentionally rejected), with no change to runtime behavior.
  • Chores
    • Updated the build container’s builder stage to include additional Go dependency manifest files for the rpctest component, improving dependency resolution consistency during builds.

The comment referenced evanphx/json-patch#158, which has since been merged. ORY's closed-reference notifier flags merged/closed PRs, so the link was reported as a stale reference (ory#1254).

Replace it with a description of the actual behavior: only "add", "remove", and "replace" operations are accepted; "move", "copy", and "test" are intentionally rejected. This is durable and no longer points at a closed reference.

Closes ory#1254

Signed-off-by: Mohamad Reza Chegini <mrchcoin@gmail.com>
@telegraphchi telegraphchi requested review from a team and aeneasr as code owners June 17, 2026 18:52
@coderabbitai

coderabbitai Bot commented Jun 17, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 079b8fb7-a97e-4bc1-b556-92288b9fef4a

📥 Commits

Reviewing files that changed from the base of the PR and between 378af7f and ca75ce2.

📒 Files selected for processing (1)
  • .docker/Dockerfile-build

📝 Walkthrough

Walkthrough

A clarifying inline comment is added to ApplyJSONPatch in oryx/jsonx/patch.go documenting that only the add, remove, and replace JSON patch operations are supported and that move, copy, and test are intentionally rejected. The Docker builder stage is also updated to copy Go module dependency files for the oryx and middleware/rpctest submodules before running go mod download.

Changes

ApplyJSONPatch operation support documentation

Layer / File(s) Summary
ApplyJSONPatch supported-ops comment
oryx/jsonx/patch.go
Inline comment added documenting that only add, remove, and replace are supported and that move, copy, and test are rejected.

Docker builder dependency manifests

Layer / File(s) Summary
Builder dependency files copying
.docker/Dockerfile-build
COPY instruction now includes oryx/go.sum and middleware/rpctest submodule manifests (go.mod and go.sum) prior to go mod download, replacing a previous copy step.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related issues

  • #1254 — The closed upstream reference at oryx/jsonx/patch.go#L65 (which pointed to github.com/evanphx/json-patch/pull/158) is replaced by a self-contained inline comment explaining the operation restriction, directly addressing the stale reference flagged by that issue.
🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name Status Explanation Resolution
Out of Scope Changes check ⚠️ Warning The raw summary shows changes to both oryx/jsonx/patch.go and .docker/Dockerfile-build, but only patch.go is mentioned in PR objectives. Dockerfile changes appear to be out of scope. Clarify whether the Dockerfile-build changes are intentional for this PR or if they were accidentally included. Remove out-of-scope changes or explain their relationship to closing issue #1254.
Description check ❓ Inconclusive Description includes what, why, and how sections with clear context. However, the PR description does not follow the provided template structure with sections like 'Related issue(s)' and 'Checklist'. Consider following the repository's PR description template to ensure consistency and completeness of required sections and checklist items.
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed Title accurately describes the main change: removing a stale upstream reference in the jsonx patch file, matching the PR's primary objective.
Linked Issues check ✅ Passed The PR successfully addresses issue #1254 by replacing the stale upstream reference with a durable inline comment describing the supported JSON patch operations.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@oryx/jsonx/patch.go`:
- Around line 63-64: Update the API contract documentation for the JSONPatch.Op
field in the openapix/jsonpatch.go file (around line 15) to clarify that only
the three operations "add", "remove", and "replace" are supported, rather than
documenting all six RFC 6902 operations as valid. This will align the API
documentation with the actual implementation behavior defined in the opAllowList
and error handling in patch.go, preventing confusion for API clients about which
operations are actually supported.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2f47d92a-25f1-46aa-b5ff-6b7eaf8d422c

📥 Commits

Reviewing files that changed from the base of the PR and between 2b618d9 and 378af7f.

📒 Files selected for processing (1)
  • oryx/jsonx/patch.go

Comment thread oryx/jsonx/patch.go
Comment on lines +63 to +64
// Only "add", "remove", and "replace" operations are supported; "move",
// "copy", and "test" are intentionally rejected.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, locate and read the API contract file
echo "=== Checking oryx/openapix/jsonpatch.go ==="
if [ -f "oryx/openapix/jsonpatch.go" ]; then
  wc -l oryx/openapix/jsonpatch.go
  echo "--- Lines 1-50 of oryx/openapix/jsonpatch.go ---"
  head -50 oryx/openapix/jsonpatch.go | cat -n
else
  echo "File not found at oryx/openapix/jsonpatch.go"
  find . -name "jsonpatch.go" -type f
fi

Repository: ory/oathkeeper

Length of output: 1606


🏁 Script executed:

# Read the implementation file to verify opAllowList and error handling
echo "=== Checking oryx/jsonx/patch.go ==="
if [ -f "oryx/jsonx/patch.go" ]; then
  wc -l oryx/jsonx/patch.go
  echo "--- Lines 1-80 of oryx/jsonx/patch.go ---"
  head -80 oryx/jsonx/patch.go | cat -n
else
  echo "File not found at oryx/jsonx/patch.go"
  find . -name "patch.go" -type f
fi

Repository: ory/oathkeeper

Length of output: 2968


🏁 Script executed:

# Verify that there are no other usages or configurations that might support move/copy/test
echo "=== Searching for move/copy/test operation references ==="
rg "(move|copy|test)" oryx/jsonx/ -i --context=2

echo ""
echo "=== Checking if there are any comments or issues referencing the RFC 6902 restriction ==="
rg "RFC 6902|move|copy" --type go -i

Repository: ory/oathkeeper

Length of output: 38146


Document mismatch between API contract and implementation.

The new comment accurately documents what the code does. However, it reveals a cross-file contract/behavior mismatch: the API contract in oryx/openapix/jsonpatch.go (line 15) documents the JSONPatch.Op field as supporting "add", "remove", "replace", "move", "copy", and "test" per RFC 6902. Yet the implementation intentionally rejects move/copy/test operations (via opAllowList at lines 17–21 and the error at line 66).

API clients reading the JSONPatchDocument documentation would expect those six operations to be valid, but ApplyJSONPatch will reject them with "unsupported operation" errors. This mismatch could break integrations or confuse new API users.

Update the API contract in oryx/openapix/jsonpatch.go to clarify that only "add", "remove", and "replace" are actually supported.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@oryx/jsonx/patch.go` around lines 63 - 64, Update the API contract
documentation for the JSONPatch.Op field in the openapix/jsonpatch.go file
(around line 15) to clarify that only the three operations "add", "remove", and
"replace" are supported, rather than documenting all six RFC 6902 operations as
valid. This will align the API documentation with the actual implementation
behavior defined in the opAllowList and error handling in patch.go, preventing
confusion for API clients about which operations are actually supported.

The replace directives in go.mod point to ./middleware/rpctest and
./oryx. go mod download needs the go.mod and go.sum for each replaced
module to resolve dependencies, but only oryx/go.mod was copied and
oryx/go.sum was being written to the wrong path (proto/go.sum).

Add the missing middleware/rpctest/go.{mod,sum} COPY steps and fix
the oryx/go.sum destination so the scanner Docker build succeeds.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

upstream reference closed: github.com/evanphx/json-patch/pull/158

1 participant