Document multi-value claims with rowBoundaries operator:in (and their per-record application)
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 70/100
- Issue 类型
- 文档
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- markdown, rust, yaml
调研方向
首先阅读 crates/registry-breg/src/api/mod.rs (~2849) 和 authority.rs (~190) 以确认 In 的多值处理，然后阅读 auth.rs 和 context.rs 了解 per-record AND。定位 authoring 文档（例如 docs/）并添加一个关于多值 claims 使用 operator: in、fail-closed 行为以及提及 bregctl explain access 的章节。Done 表示文档清晰涵盖 dev-clients 语法和 silent failure modes。
由索引模型根据 Issue 内容生成。
描述
Summary
rowBoundaries supports operator: in with multi-value claims, and the boundary applies independently to every referenced record of that type. This is the only way we found to model a caller authorized over several records of the same type in one action (e.g. a representative filing a merger over two companies), but it does not appear to be documented anywhere we looked, and the failure modes are silent.
Proven behaviour (live, origin/main 634eba0b2)
dev-clients.yaml accepts an array claim:
claims:
registry_represented_brns: [SAMPLE-LR-A, SAMPLE-LR-B]
and a target boundary:
targets:
- recordType: company
rowBoundaries: [{field: brn, claim: registry_represented_brns, operator: in}]
- an action with two
companyreference inputs is authorized only when both referenced records match the claim set → a caller holding only[SAMPLE-LR-A]is refused at proposal start when the second company isSAMPLE-LR-B(exactly the "one-company representation is insufficient" authority check our benchmark needed) - a missing claim fails closed (
row-claim-missing-or-wrong-cardinality/ concealed) equals+ an array claim is denied; onlyinaccepts multi-value- one dev client per access profile may be claim-free (the "default"); a second client with different claims needs explicit
testBindingsor dev session start refuses with "a shared local access profile needs at most one default client"
Source pointers
crates/registry-breg/src/api/mod.rsverified_row_boundaries_from_sources(~2849) —Equalsrequires exactly one claim value;Incarries all valuescrates/registry-breg/src/authority.rs~190 —multi_valueset forBoundaryOperator::Incrates/registry-breg/src/auth.rsmap_authority_claim(~799) — array claims mapped per entrycrates/registry-breg/src/postgres/context.rssnapshot_matches_boundaries(~1243) — per-record AND semantics
Ask
Document multi-value claims + operator: in (dev-clients syntax, per-record application, fail-closed behaviour) in the authoring docs; a bregctl explain access mention would also help. If per-record application is not intended semantics for multi-reference actions, that is worth stating explicitly too.
- 主要语言
- Rust
- 星标
- 2
- 派生
- 0
- 平均合并
- 7 小时 52 分钟
- 30 天内合并 PR
- 264
环境准备
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
registrystack/registry-stack 的其他 Issue
-
area:breg criticality:p3 documentation good first issue triage:needs-implementation
难度 1/5 1 小时以内 新手友好度 85/100
registrystack/registry-stack#2415 ·
维护者通常 1 天内回复
-
scheduling: profile refusals on appointment detail, busy-import and operational routes log nothing未关闭area:scheduling criticality:p3 enhancement triage:needs-implementation
难度 2/5 1-3 小时 新手友好度 85/100
registrystack/registry-stack#2412 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 85/100
registrystack/registry-stack#2381 ·
维护者通常 1 天内回复
-
area:docs documentation
难度 2/5 1-3 小时 新手友好度 76/100
registrystack/registry-stack#2253 ·
维护者通常 1 天内回复
-
area:coordinator bug
难度 2/5 1-3 小时 新手友好度 82/100
registrystack/registry-stack#2252 ·
维护者通常 1 天内回复
查看 registrystack/registry-stack 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 61/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 84/100
rust-embedded/heapless#694 ·
-
难度 1/5 1 小时以内 新手友好度 75/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
farion1231/cc-switch#8899 · 2 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100
manuscript-lang/manuscript#1364 ·
维护者通常 1 天内回复