RHCLOUD-47156: Add guide for protecting list endpoints#117
Merged
Conversation
Implements RHCLOUD-47156 with documentation covering four authorization patterns for list endpoints: - Pre-filtering (coarse): workspace-level filtering with StreamedListObjects - Pre-filtering (fine): resource-level filtering with StreamedListObjects - Post-filtering (coarse): workspace checks on query results - Post-filtering (fine): per-resource checks with CheckBulk Includes code examples in Python and Go using SDK helpers, real-world references to Digital Roadmap and Config Manager implementations, performance guidance, and a decision flowchart. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Fix O(n²) performance bug in post-filter-bulk.py by using enumerate() instead of index() lookup inside loop - Improve Mermaid diagram readability in dark mode by adding explicit black text color (color:#000) to all diagram nodes Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
|
||
| **Implementation:** | ||
|
|
||
| <CodeExamples files={preFilterCoarse} regions="get-workspaces" /> |
Contributor
There was a problem hiding this comment.
Seems like "Coarse-grained: Workspace-level filtering" is the only section that has code examples in multiple languages. Should we also add examples for the other supported languages or at least Go examples for the other sections since we are showcasing both atm
Contributor
Author
There was a problem hiding this comment.
Added more examples - sorry (they are a lot)!
Address critical issues found by language-specific SDK review agents: Python (4 files): - Change client → stub to match SDK naming - Remove async/await, use sync pattern with .build() - Use PascalCase methods: CheckBulk, StreamedListObjects - Use list_workspaces instead of list_workspaces_async Go (2 files): - Fix import paths: remove separate allowed/check_bulk_request packages - Use v1beta2.CheckBulkRequest, v1beta2.Allowed_ALLOWED_TRUE TypeScript (4 files): - Change .build() → .buildAsync() for promise-based APIs Ruby (1 file): - Fix hash access: .workspace_id → [:workspace_id] Java (4 files): - Add comment about channel cleanup (not environment-specific) All changes verified against actual SDK examples in respective repositories. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
lennysgarage
left a comment
lennysgarage
left a comment
Contributor
There was a problem hiding this comment.
Just found some issues with the Go examples rest looks great!
Use GetItem() method instead of accessing Item field directly. Matches SDK example pattern from examples/grpc/check_bulk.go. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Jonathan Marcantonio <lennysgarage1@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds comprehensive documentation for protecting list endpoints with Kessel authorization, covering the four main patterns teams use in production.
What's included
Documentation (
protect-list.mdx)StreamedListObjectsStreamedListObjectsCheckBulkCheckBulkEach pattern includes:
Code Examples
list_workspaces_async,CheckBulk,principal_subject, etc.)Real-World References
StreamedListObjectsDecision Support
Jira
Closes RHCLOUD-47156
Acceptance Criteria Met
🤖 Generated with Claude Code