Atomic CLI related leftovers around name based lookups by noise64 · Pull Request #3798 · golemcloud/golem

noise64 · 2026-08-31T13:22:16Z

resolves GOL-327
adds exact natural-key registry lookups for accounts, plugins, agent secrets, retry policies, security schemes, and domain registrations
switches CLI resource resolution from list-and-search to generated atomic client methods while keeping ID-based mutations
resolves account-qualified application/environment references atomically and supports manifest-driven creation for explicit accounts while keeping explicit references lookup-only
adds consistent --account <EMAIL> / --account-id <UUID> scope to account, card, and plugin commands
supports plugin name/version and explicit --id identities, with documented conflicts and explicit-account list semantics
removes retired component-plugin parser/handler scaffolding and updates ignored legacy tests with the retired-workflow reason
rewrites current CLI plugin documentation and the plugin-management skill around registry commands and declarative manifests
adds parser, SQLite/PostgreSQL repository, and generated-client integration coverage
regenerates OpenAPI, REST API reference docs, and skill-derived how-to guides

netlify · 2026-08-31T13:22:22Z

✅ Deploy Preview for golemcloud canceled.

Name	Link
🔨 Latest commit	`b9d8a9b`
🔍 Latest deploy log	https://app.netlify.com/projects/golemcloud/deploys/6aa43844b7a7540008a1538e

github-actions · 2026-08-31T13:27:53Z

📖 Docs preview: https://docs-eq5x12xei-golem-cloud.vercel.app

Built from commit b9d8a9b76160fc4a48750c0a3971105ac85b2fc4 by docs.yaml.

# Conflicts: # cli/golem-cli/src/command.rs # cli/golem-cli/src/command_handler/account.rs # golem-registry-service/tests/repo/mod.rs # golem-registry-service/tests/repo/postgres.rs # golem-registry-service/tests/repo/sqlite.rs

#3824 added `leadership` to golem_shard_manager::RunDetails; #3840's local_server_system_memory_override test constructs RunDetails without it, so the golem lib test failed to compile (a semantic conflict that landed on main). the test only exercises memory-config plumbing, so leadership: None. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S5f7dgMarefJrfRRd9Xmww

vigoo · 2026-09-10T10:48:44Z

Agent review on behalf of @vigoo:

[P2] Natural-key resource lookups require an extra parent-environment permission

The new secret, retry-policy, domain, and security-scheme lookups first call EnvironmentService::get(..., auth), which requires EnvironmentVerb::View, before checking permission to view the requested resource.

Locations: agent secrets, retry policies, domains, and security schemes.

For example, if Alice shares permission to view one secret with Bob without granting environment-view permission, GET /v1/agent-secrets/<secret-id> succeeds, but GET /v1/envs/<environment-id>/agent-secrets/by-path?path=foo&path=bar returns 404. The existing ID lookup loads ownership metadata and checks the secret permission directly; the new lookup rejects Bob at the parent check despite his valid resource grant.

Suggested fix: load the resource and ownership metadata without imposing parent-view permission, then authorize the resource directly, as the new plugin lookup does. Add positive granular-sharing tests for these endpoints, not just owner success and unrelated-user rejection.

[P2] --account <EMAIL> requires broader permissions than --account-id

The new account-scope resolver resolves email through get_account_by_email, which requires AccountVerb::View. Supplying an account ID skips that check and proceeds to the resource operation.

The PR’s plugin integration test grants only account.plugin(alice@example.com) @ bob@example.com : view : my-plugin. With that permission, golem plugin get my-plugin 1.0.0 --account-id <alice-account-id> succeeds, but golem plugin get my-plugin 1.0.0 --account alice@example.com fails during account resolution, before the plugin lookup. The advertised email/ID scope alternatives therefore behave differently under least-privilege sharing.

Suggested fix: resolve account-qualified resource identities within a resource-authorized server lookup rather than fetching the full account DTO first. Keep authorization on the full account endpoint, and extend the granular plugin-sharing test through the CLI email form.

Both findings are based on tracing the authorization paths; live two-account reproductions were not run.

secret, retry-policy, domain and security-scheme by-path/by-name lookups loaded the environment via EnvironmentService::get, which enforces EnvironmentVerb::View, purely to read the ownership triple for the permission target. a caller holding only the resource grant (but no environment view) got a 404, while the by-id lookup succeeded. add EnvironmentService::get_owner_unchecked and authorize the resource directly against it, matching the by-id path.

for secrets, retry-policies, security-schemes and domains: grant view on a single resource without environment-view, and assert the by-path/by-name lookup succeeds (it 404'd before the fix).

get_account_plugin authorizes on the plugin grant alone, but the CLI's --account <email> scope resolved the email through get_account_by_email, which requires AccountVerb::View, so it needed more than --account-id. add a by-email endpoint that resolves the owner account without an account-view check (via a new AccountService::resolve_account_id_by_email_unchecked) and authorizes the plugin grant, matching the by-id form. regenerate openapi spec and rest-api docs.

add AccountHandler::select_account_scope_or_err returning the scope without collapsing an email to an id up front. plugin get and unregister now dispatch --account <email> to the by-email endpoint and --account-id to the by-id one, so the email scope no longer requires AccountVerb::View.

with only a plugin-view grant (no account-view), assert the by-email lookup is 404 before the grant and succeeds after, matching the by-id and account-id forms.

# Conflicts: # golem-registry-service/src/api/agent_secrets.rs # integration-tests/tests/api/agent_secret.rs

domain registration is globally unique, so reusing test1.golem.cloud collided with register_and_fetch_domain and failed with DOMAIN_ALREADY_EXISTS before the permission check ran. use test6.golem.cloud.

only the missing-account case should map to not-found; db/decoding errors from the unchecked email resolution were being turned into 404, unlike the by-id endpoint.

Add atomic CLI resource lookups

c1a3dcb

noise64 added 6 commits September 1, 2026 11:41

Merge remote-tracking branch 'origin/main' into cli-id-vs-name-cleanup

3801cab

Complete atomic CLI resource cleanup

5bb07b8

Address CLI cleanup review feedback

d9618d0

Preserve qualified environment lookup UX

e2eb2d2

Fix account-qualified lookup regressions

5bd487b

noise64 changed the title ~~Add atomic CLI resource lookups~~ Atomic CLI related leftovers around name based lookups Sep 9, 2026

noise64 and others added 3 commits September 9, 2026 16:46

Merge remote-tracking branch 'origin/main' into cli-id-vs-name-cleanup

0a22be4

ci: trigger fresh run with valid run-scoped caches

bf7a93a

noise64 marked this pull request as ready for review September 10, 2026 10:01

noise64 requested a review from a team September 10, 2026 10:01

Merge remote-tracking branch 'origin/main' into cli-id-vs-name-cleanup

eb79b5d

noise64 added 8 commits September 11, 2026 14:47

test: granular resource-view sharing for by-path/by-name lookups

826763a

for secrets, retry-policies, security-schemes and domains: grant view on a single resource without environment-view, and assert the by-path/by-name lookup succeeds (it 404'd before the fix).

test: cover by-email plugin lookup under granular sharing

b23739b

with only a plugin-view grant (no account-view), assert the by-email lookup is 404 before the grant and succeeds after, matching the by-id and account-id forms.

Merge remote-tracking branch 'origin/main' into cli-id-vs-name-cleanup

9e2243b

# Conflicts: # golem-registry-service/src/api/agent_secrets.rs # integration-tests/tests/api/agent_secret.rs

fmt: wrap agent-secret by-path dto conversion

cf5b66e

Merge remote-tracking branch 'origin/main' into cli-id-vs-name-cleanup

79d1306

vigoo approved these changes Sep 11, 2026

View reviewed changes

noise64 added 2 commits September 11, 2026 18:03

test: use a distinct domain in granular domain-sharing test

66a6952

domain registration is globally unique, so reusing test1.golem.cloud collided with register_and_fetch_domain and failed with DOMAIN_ALREADY_EXISTS before the permission check ran. use test6.golem.cloud.

registry: propagate internal errors from by-email plugin lookup

1211ec1

only the missing-account case should map to not-found; db/decoding errors from the unchecked email resolution were being turned into 404, unlike the by-id endpoint.

noise64 enabled auto-merge (squash) September 11, 2026 16:35

Merge remote-tracking branch 'origin/main' into cli-id-vs-name-cleanup

01a597e

noise64 added 2 commits September 11, 2026 18:49

Merge remote-tracking branch 'origin/main' into cli-id-vs-name-cleanup

2af8185

Merge remote-tracking branch 'origin/main' into cli-id-vs-name-cleanup

b9d8a9b

Navigation Menu

Uh oh!

Atomic CLI related leftovers around name based lookups - #3798

Atomic CLI related leftovers around name based lookups#3798
noise64 wants to merge 24 commits into
mainfrom
cli-id-vs-name-cleanup

noise64 commented Aug 31, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

vigoo commented Sep 10, 2026

[P2] Natural-key resource lookups require an extra parent-environment permission

[P2] `--account <EMAIL>` requires broader permissions than `--account-id`

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

noise64 commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for golemcloud canceled.

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vigoo commented Sep 10, 2026

[P2] Natural-key resource lookups require an extra parent-environment permission

[P2] --account <EMAIL> requires broader permissions than --account-id

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

noise64 commented Aug 31, 2026 •

edited

Loading

netlify Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

[P2] `--account <EMAIL>` requires broader permissions than `--account-id`