Certification Scenario - Should `delete` appear in Action Search results?

Open
  • Is something wrong?
#780 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@alexolivier is already working on this.

Since Oct 29, 2026.

  • #793 by @alexolivier — open

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
testing-qa

Research direction

Start with the Action Search fixture check (S3), the permitted-results module, and the cited scenario §§4.4–4.5 and spec §8.1. Trace how the suite handles actions whose decisions depend on properties, then determine whether delete belongs in the results and whether the permitted-results check should skip it. Done means the fixture and check express a consistent interpretation of the cited requirements.

Written by the indexing model from the issue text.

Description

authorization-api certification

For subject alice performing action delete with properties.soft = true on resource record-1: the decision MUST be true. For subject alice performing action delete with properties.soft = false on resource record-1: the decision MUST be false. (scenario §4.4, rules 7 and 8)

Note: delete is excluded from the Properties Action Search fixture. Action Search omits the action key from requests per the spec, so action.properties.soft cannot be provided. Action Search results return action names only, without constraining properties. (scenario §4.5)

any result from a Search API, when subsequently used in an Access Evaluation API call, SHOULD result in a "decision": true response. (spec §8.1)

Whether alice may delete record-1 depends on soft, which an Action Search result does not carry. A PDP may or may not list delete among the actions alice can perform on record-1. If it lists it, an Access Evaluation request built from that result has no soft, and the fixture defines no decision for it.

Suite today. The Action Search fixture check (S3) requires read and write, and allows other actions. The permitted-results module sends each of the first 10 results to the Access Evaluation API as an action name only, and reports a false decision as a warning (§8.1 SHOULD). A PDP that lists delete and denies it without soft gets that warning.

Questions.

  1. Should Action Search results for alice on record-1 include delete?
  2. If a PDP lists an action whose decision depends on its properties, should the §8.1 check skip it, since the result cannot carry the properties?
Dominant language
TypeScript
Stars
170
Forks
46
Avg merge
18h 5m
Merged PRs (30d)
43

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openid/authzen

All issues in openid/authzen

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.