Skip to content

chore(cli): map pull command permissions - #7180

Merged
Prashansa-K merged 4 commits into
developfrom
chore/cli-permission-map-pull
Oct 15, 2026
Merged

Prashansa-K merged 4 commits into
developfrom
chore/cli-permission-map-pull

Conversation

@Prashansa-K

Copy link
Copy Markdown
Contributor

Maps the top-level pull command to the Management API operations it calls.

pull composes the config-pull, linked-project cache, database config and function-download blocks directly, because its sub-commands' declarations describe different flags and gating. The database and function steps are gated on --dry-run being false, since a dry run stops after the target and config reads. pull also declares its own pooler-config entry: its database steps always get the resolved ref, so the pooler fetch happens without --project-ref.

Findings: a bootstrap run resolves the database twice, so it fetches the pooler config and mints a login role twice; step failures are isolated but pull still fails, so every step call is required.

Untested conditions: a declined confirmation (it over-declares, like --dry-run), a failing step under the real layers, and a branch-name target under the real layers. dbConfigLinked, dbConfigPoolerFallbackLinked and the own pooler entry overlap, so dropping one alone fails no test. No blocks without a real-layer test, no best-effort label turned required, no OPERATIONS_WITHOUT_FGA entries.

🤖 Generated with Claude Code

Prashansa-K and others added 3 commits October 15, 2026 15:53
pull composes the config-pull, database and function-download blocks directly. The steps after
the config read run only without --dry-run, so they carry an is: false condition on it. The
database steps always receive the resolved ref, so the pooler fetch needs no --project-ref and
gets its own entry.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The real database config resolver and linked-project cache now run in the pull tests, so the
drift check sees the pooler, login role, config, function and cache calls. Covers a bootstrap run
with and without --project-ref, --dry-run, the project picker and the IPv6 retry.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@Prashansa-K
Prashansa-K requested a review from a team as a code owner October 15, 2026 10:32

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 AI Review

Both independent reviews completed and reported no findings. Reading the changed files, handler, shared permission blocks, and test helpers supports that result: the declarations cover dry-run behavior, resolved project refs, cache fills, and pooler fallback. No fundamental conflict with the supplied next-branch work was identified. Tests were not run during adjudication.

Findings

No issues found.

Stats

Claude findings: 0 · Codex findings: 0 · Confirmed: 0 · Refuted: 0 · Uncertain: 0


Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

@Prashansa-K
Prashansa-K added this pull request to the merge queue Oct 15, 2026
@Prashansa-K
Prashansa-K removed this pull request from the merge queue due to a manual request Oct 15, 2026
…on-map-pull

# Conflicts:
#	apps/cli/tests/helpers/permission-pending-commands.ts
@Prashansa-K
Prashansa-K enabled auto-merge October 15, 2026 11:11
@Prashansa-K
Prashansa-K added this pull request to the merge queue Oct 15, 2026
Merged via the queue into develop with commit a982140 Oct 15, 2026
39 checks passed
@Prashansa-K
Prashansa-K deleted the chore/cli-permission-map-pull branch October 15, 2026 11:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants