fix(monitors,synthetics_tests): drop stale restricted_roles/principals under new flag (3/4)#631
Draft
michael-richey wants to merge 1 commit into
Conversation
…s under new flag Applies the same drop-aware pattern (PR1 helpers) to the two resource types that carry both a flat `restricted_roles` list and a `restriction_policy.bindings.principals` composite: - monitors: `restricted_roles` + `restriction_policy.bindings.principals` - synthetics_tests: `options.restricted_roles` + `restriction_policy.bindings.principals` Each `connect_resources` override keeps all non-access-control connections on the generic path, filters access-control references through the shared helpers, and preserves the empty-binding/empty-list access-elevation hard-fail. `extract_source_ids` left unaffected (documented). Behavior is unchanged when `--drop-unresolvable-principals` is off. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
michael-richey
force-pushed
the
drop-unresolvable-principals-restriction-policies
branch
from
c0fbb7e to
76bcbff
Compare
michael-richey
force-pushed
the
drop-unresolvable-principals-monitors-synthetics
branch
from
518113c to
27fd78f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Stacked PR 3 of 4. Base:
drop-unresolvable-principals-restriction-policies(PR #630).This PR
Applies the same drop-aware pattern (PR #629 helpers) to the two resource types carrying both a flat
restricted_roleslist and arestriction_policy.bindings.principalscomposite:restricted_roles+restriction_policy.bindings.principalsoptions.restricted_roles+restriction_policy.bindings.principalsEach
connect_resourcesoverride keeps non-access-control connections (query/composite/slo-alert, private locations, subtests, global variables, rum/mobile apps) on the generic path, filters access-control references through the shared helpers, and preserves the empty-binding/empty-list access-elevation hard-fail.extract_source_idsleft unaffected (documented). Unchanged when the flag is off.Testing
New
connect_resourcesdrop suites intest_monitors.pyandtest_synthetics_tests.pycovering both the composite and flat-list shapes (drop, empty-risk, middle-element regression, flag-off). Green;ruffclean.🤖 Generated with Claude Code