GeezerVison is showing github.com — ROX-37923: Use existence checks in role and access-scope validation by dashrews78 · Pull Request #24042 · stackrox/stackrox
Conversation
Description
Fixes ROX-37923 (epic ROX-37919).
The role, permission-set and access-scope uniqueness validators loaded the full object (Get) only to test whether it exists. They now use the store's Exists method, which is a COUNT query (pkg/search/postgres/store.go:181).
- Added
Exists to the hand-written RoleStore and PermissionSetStore interfaces. The generated postgres stores already expose it; SimpleAccessScopeStore already declared it.
verifyPermissionSetIDDoesNotExist, verifyAccessScopeIDDoesNotExist and verifyRoleNameDoesNotExist now call Exists.
errox.AlreadyExists behavior and error text are unchanged; a failing read still propagates.
Alternatives considered: using Count with a doc-ID query directly in the datastore. Rejected in favor of the store-level Exists used elsewhere in the epic and already present in the generated stores.
User-facing documentation
Testing and quality
- the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
- CI results are inspected
Automated testing
- added unit tests
- added e2e tests
- added regression tests
- added compatibility tests
- modified existing tests
How I validated my change
Existing postgres datastore tests already cover both outcomes of each validator (duplicate -> errox.AlreadyExists, missing -> success), so no new tests were added:
go test -tags sql_integration ./central/role/datastore/... -run TestRoleDataStore -count=1 # ok
go test -tags sql_integration ./central/role/store/... -count=1 # ok
Mocks regenerated with go generate for central/role/store.
🤖 Generated with Claude Code
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Add Exists to the role and permission-set store interfaces and use it in
the three uniqueness validators, replacing full-object reads with a COUNT
query. The concrete postgres stores already expose Exists; only the
hand-written interfaces were missing it.
AlreadyExists behavior is unchanged and covered by the existing postgres
datastore tests (present and absent cases).
User request: "Lets start 37923, move it and the epic to In Progress.
Make sure you start with a fresh branch. Make the PR ready for review."
Code was partially generated by AI (Claude Code).
Co-Authored-By: Claude Code <[email protected]>
|
Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
coderabbitai
Bot
commented
Nov 12, 2026
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
|
No actionable comments were generated in the recent review.
Summary
-
Summary by CodeRabbit
- Bug Fixes
- Permission-set, access-scope, and role checks continue to report when an ID or name is already in use, while preserving storage errors. These checks now rely on direct existence results rather than retrieving the full record, with no change to the reported outcomes.
The role store interfaces and mocks add Exists methods. Three datastore checks use store existence methods instead of fetching full objects with Get.
Changes: Role Existence Checks
| Layer / File(s) |
Summary |
Store existence contracts central/role/store/store.go, central/role/store/mocks/store.go |
PermissionSetStore and RoleStore add Exists methods. Their generated mocks and recorders add matching methods. |
Datastore existence checks central/role/datastore/datastore_impl.go |
Permission-set ID, access-scope ID, and role-name checks use Exists instead of Get. Storage errors continue to pass through, and existing keys still return AlreadyExists. |
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Refactor
Merge Risk: Minimal · up to 7621e
-
The change replaces full-object reads with existence checks in role and access-scope validation. Duplicate detection and error behavior are described as unchanged. No actionable merge risk was identified.
Pre-merge checks: 4
-
| Check name |
Status |
Explanation |
| Title check |
 |
The title names the main change: role, permission-set and access-scope uniqueness validators switch from full-object Get calls to Exists checks. It matches the summary and objectives, and it is specif… |
| Description check |
 |
The description covers the change, the new Exists declarations, the unchanged AlreadyExists behavior, and the validation commands. It follows the template structure with the User-facing documentation … |
| Linked Issues check |
 |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check |
 |
Check skipped because no linked issues were found for this pull request. |
Full details: Title check
-
Explanation
The title names the main change: role, permission-set and access-scope uniqueness validators switch from full-object Get calls to Exists checks. It matches the summary and objectives, and it is specific and concise.
Full details: Description check
-
Explanation
The description covers the change, the new Exists declarations, the unchanged AlreadyExists behavior, and the validation commands. It follows the template structure with the User-facing documentation and Testing sections. Some items remain unchecked: CI results are not inspected, and no unit, e2e, regression, compatibility, or modified-test items are checked. The author gives a reason for adding no new tests, which the template accepts. The Testing and quality and Automated testing sections need the author to confirm CI status and state the test rationale more directly. The template's 'change me!' placeholders are replaced. The description is mostly complete.
Recent review info
-
Run configuration
-
- Source mode: Auto
- Repository: Unavailable
- Branch: Unavailable
- File: No configuration file from this repository applied
- Commit: Unavailable
- Layers: Central YAML (base), Organization UI (inherited)
- Review profile: CHILL
- Plan: Enterprise
- Run ID:
479dfd8b-a67e-4840-bb12-c0df407b9775
Commits
-
Reviewing files that changed from the base of the PR and between 34e955b and 7621eb8.
Files selected for processing: 3
-
central/role/datastore/datastore_impl.go
central/role/store/mocks/store.go
central/role/store/store.go
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 52.86%. Comparing base (34e955b) to head (7621eb8).
Additional details and impacted files
@@ Coverage Diff @@
## master #24042 +/- ##
==========================================
- Coverage 52.90% 52.86% -0.05%
==========================================
Files 2755 2755
Lines 175277 175277
==========================================
- Hits 92732 92654 -78
- Misses 74479 74537 +58
- Partials 8066 8086 +20
Flags with carried forward coverage won't be shown. Click here to find out more.
☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.
🚀 New features to boost your workflow:
- 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
🚀 Build Images Ready
Images are ready for commit 7621eb8. To use with deploy scripts:
export MAIN_IMAGE_TAG=5.1.x-569-g7621eb8827
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
/konflux-retest create-custom-snapshot
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
2 similar comments
|
/konflux-retest create-custom-snapshot
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
/konflux-retest create-custom-snapshot
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
This branch has not been deployed
No deployments
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|