Skip to content

Bug fixes for security policies on API resources - #9908

Merged
k-anshul merged 4 commits into
mainfrom
stricter_claims_apis
Sep 23, 2026
Merged

Bug fixes for security policies on API resources#9908
k-anshul merged 4 commits into
mainfrom
stricter_claims_apis

Conversation

@k-anshul

@k-anshul k-anshul commented Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Immediate follow up: Opening a report through a recipient token expands transitive access, which initializes the report's resolver with the caller's claims. Resolvers that resolve security at init (e.g. metrics, metrics_sql, api) then re-expand the same transitive rules, and the expansion recurses until stack overflows.

Checklist:

  • Covered by tests
  • Ran it and it works as intended
  • Reviewed the diff before requesting a review
  • Checked for unhandled edge cases
  • Linked the issues it closes
  • Checked if the docs need to be updated. If so, create a separate Linear DOCS issue
  • Intend to cherry-pick into the release branch
  • I'm proud of this work!

@k-anshul k-anshul self-assigned this Sep 21, 2026
@k-anshul k-anshul changed the title Stricter claims apis Bug fixes for security policies on API resources Sep 21, 2026
@k-anshul
k-anshul marked this pull request as draft September 21, 2026 10:24
@k-anshul
k-anshul force-pushed the stricter_claims_apis branch from 70cdd51 to 2d2deb1 Compare September 22, 2026 07:03
@k-anshul
k-anshul marked this pull request as ready for review September 22, 2026 10:27
begelundmuller
begelundmuller approved these changes Sep 22, 2026
View reviewed changes

@begelundmuller begelundmuller left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Everything else looks good to me :)

Comment thread runtime/server/api.go Outdated
@k-anshul
k-anshul merged commit bd02ec6 into main Sep 23, 2026
12 checks passed
@k-anshul
k-anshul deleted the stricter_claims_apis branch September 23, 2026 05:12
@k-anshul k-anshul mentioned this pull request Sep 23, 2026
Open
3 of 8 tasks
nishantmonu51 pushed a commit that referenced this pull request Sep 23, 2026
@k-anshul @nishantmonu51
Bug fixes for security policies on API resources (#9908)
a1441b2 
* Bug fixes for security policies on API resources- #9908

* self review

* review comments

* fix tests

(cherry picked from commit bd02ec6)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@begelundmuller begelundmuller begelundmuller approved these changes
@nishantmonu51 nishantmonu51 Awaiting requested review from nishantmonu51

Assignees

@k-anshul k-anshul

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@k-anshul @begelundmuller