fix: tolerate auth-filtered projections instead of crashing on pull - #299
Merged
Conversation
When an entire multi-resource YAML type is absent from the incoming projection, its per-resource deletions were batched into the file cache and then discarded when the pull returned - the pruned file never reached disk. The leftover cache entry was also stamped with the file's pre-write mtime, so the staleness check treated it as fresh and every later read in the process saw a file state that was not on disk. The visible symptom was a pull that had to be run twice before poly diff came back clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The API filters projections per permission slice: a user without read access to a slice gets a skeleton carrying only identity fields, with the substantive fields stripped. Pulling as a restricted reader either crashed on a missing field (KeyError on name/actions/description) or built resources from the skeleton - empty-named keyphrases and phrase filters collapsing onto one file path and failing the duplicate-path check. Every from_projection now detects an auth-filtered or absent slice and drops that resource type for the pull, logging at debug level. Guards test field presence, never truthiness, so falsy-but-readable values (empty content, active=False) are not mistaken for filtered ones. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
8 tasks
Contributor
Coverage Report
Changed file coverage
|
jamesosullivan-polyai
approved these changes
Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The API filters projections per permission slice: a user without read access to a slice
gets a skeleton carrying only identity fields, with the substantive fields stripped.
Every
from_projectionnow detects an auth-filtered or absent slice and drops thatresource type for the pull instead of crashing or building resources from the skeleton.
First of two PRs replacing #288 (stacked on #298; the follow-up adds slim reference
mappings so references to withheld resources still resolve to names).
Motivation
Pulling as a restricted reader fails today. All 162
pull failederrors on adk-servicein the last 30 days trace to auth-filtered slices:
KeyErroronname/actions/description— unguarded field access onskeleton entities.
Duplicate resource file path found/File not found for resource— filteredkeyphrase-boosting and phrase-filter slices parsed with empty names, collapsing every
entry onto one file path.
Changes
from_projectionguards its slice: an absent slice or one where any entity ismissing a field the API always sends for readable data is treated as withheld, logged
at debug level, and yields no resources.
content,active=False) are not mistaken for filtered ones. Sentinel fields arechosen per slice where the obvious field is optional in the API schema (e.g. variant
attributes guard on
type, notarchived; variants onisDefault, notname).functions, "jupiter_flows" gates transition functions) — losing one permission must not
hide the others.
slim_projection_test.pywith a skeleton-projection fixture built from the fieldseach slice always sends, asserting no registered resource type raises and nothing
half-built survives.
Test strategy
poly <command>)Checklist
ruff check .andruff format --check .passpytestpasses (1443 passed, 153 subtests)polyCLI interface (or migration path documented)