GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — ROX-37923: Use existence checks in role and access-scope validation by dashrews78 · Pull Request #24042 · stackrox/stackrox

Conversation

@dashrews78

@dashrews78 dashrews78 commented Nov 12, 2026

Copy link
Copy Markdown
Collaborator

Description

Fixes ROX-37923 (epic ROX-37919).

The role, permission-set and access-scope uniqueness validators loaded the full object (Get) only to test whether it exists. They now use the store's Exists method, which is a COUNT query (pkg/search/postgres/store.go:181).

  • Added Exists to the hand-written RoleStore and PermissionSetStore interfaces. The generated postgres stores already expose it; SimpleAccessScopeStore already declared it.
  • verifyPermissionSetIDDoesNotExist, verifyAccessScopeIDDoesNotExist and verifyRoleNameDoesNotExist now call Exists.
  • errox.AlreadyExists behavior and error text are unchanged; a failing read still propagates.

Alternatives considered: using Count with a doc-ID query directly in the datastore. Rejected in favor of the store-level Exists used elsewhere in the epic and already present in the generated stores.

User-facing documentation

  • CHANGELOG.md is updated OR update is not needed
  • documentation PR is created and is linked above OR is not needed

Testing and quality

  • the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

Existing postgres datastore tests already cover both outcomes of each validator (duplicate -> errox.AlreadyExists, missing -> success), so no new tests were added:

go test -tags sql_integration ./central/role/datastore/... -run TestRoleDataStore -count=1   # ok
go test -tags sql_integration ./central/role/store/... -count=1                              # ok

Mocks regenerated with go generate for central/role/store.

🤖 Generated with Claude Code

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@dashrews78 @claude
ROX-37923: Use existence checks in role and access-scope validation
7621eb8
Add Exists to the role and permission-set store interfaces and use it in
the three uniqueness validators, replacing full-object reads with a COUNT
query. The concrete postgres stores already expose Exists; only the
hand-written interfaces were missing it.

AlreadyExists behavior is unchanged and covered by the existing postgres
datastore tests (present and absent cases).

User request: "Lets start 37923, move it and the epic to In Progress.
Make sure you start with a fresh branch. Make the PR ready for review."

Code was partially generated by AI (Claude Code).

Co-Authored-By: Claude Code <[email protected]>
@dashrews78 dashrews78 added the ai-assisted label Nov 12, 2026
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress label Nov 12, 2026
@openshift-ci

openshift-ci Bot commented Nov 12, 2026

Copy link
Copy Markdown

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@dashrews78
dashrews78 marked this pull request as ready for review November 12, 2026 16:03
@github-actions github-actions Bot added the area/central label Nov 12, 2026
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress label Nov 12, 2026
@coderabbitai

coderabbitai Bot commented Nov 12, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

  • Bug Fixes
    • Permission-set, access-scope, and role checks continue to report when an ID or name is already in use, while preserving storage errors. These checks now rely on direct existence results rather than retrieving the full record, with no change to the reported outcomes.

The role store interfaces and mocks add Exists methods. Three datastore checks use store existence methods instead of fetching full objects with Get.

Changes: Role Existence Checks

Layer / File(s) Summary
Store existence contracts
central/role/store/store.go, central/role/store/mocks/store.go
PermissionSetStore and RoleStore add Exists methods. Their generated mocks and recorders add matching methods.
Datastore existence checks
central/role/datastore/datastore_impl.go
Permission-set ID, access-scope ID, and role-name checks use Exists instead of Get. Storage errors continue to pass through, and existing keys still return AlreadyExists.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Refactor

Merge Risk: Minimal · up to 7621e

The change replaces full-object reads with existence checks in role and access-scope validation. Duplicate detection and error behavior are described as unchanged. No actionable merge risk was identified.

Pre-merge checks: Passed 4

Check name Status Explanation
Title check Passed The title names the main change: role, permission-set and access-scope uniqueness validators switch from full-object Get calls to Exists checks. It matches the summary and objectives, and it is specif…
Description check Passed The description covers the change, the new Exists declarations, the unchanged AlreadyExists behavior, and the validation commands. It follows the template structure with the User-facing documentation …
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Title check

Explanation

The title names the main change: role, permission-set and access-scope uniqueness validators switch from full-object Get calls to Exists checks. It matches the summary and objectives, and it is specific and concise.

Full details: Description check

Explanation

The description covers the change, the new Exists declarations, the unchanged AlreadyExists behavior, and the validation commands. It follows the template structure with the User-facing documentation and Testing sections. Some items remain unchecked: CI results are not inspected, and no unit, e2e, regression, compatibility, or modified-test items are checked. The author gives a reason for adding no new tests, which the template accepts. The Testing and quality and Automated testing sections need the author to confirm CI status and state the test rationale more directly. The template's 'change me!' placeholders are replaced. The description is mostly complete.

Recent review info

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Central YAML (base), Organization UI (inherited)
  • Review profile: CHILL
  • Plan: Enterprise
  • Run ID: 479dfd8b-a67e-4840-bb12-c0df407b9775
Commits

Reviewing files that changed from the base of the PR and between 34e955b and 7621eb8.

Files selected for processing: 3

  • central/role/datastore/datastore_impl.go
  • central/role/store/mocks/store.go
  • central/role/store/store.go

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@codecov

codecov Bot commented Nov 12, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 52.86%. Comparing base (34e955b) to head (7621eb8).

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #24042      +/-   ##
==========================================
- Coverage   52.90%   52.86%   -0.05%     
==========================================
  Files        2755     2755              
  Lines      175277   175277              
==========================================
- Hits        92732    92654      -78     
- Misses      74479    74537      +58     
- Partials     8066     8086      +20     
Flag Coverage Δ
go-unit-tests 52.86% <100.00%> (-0.05%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@github-actions

github-actions Bot commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

🚀 Build Images Ready

Images are ready for commit 7621eb8. To use with deploy scripts:

export MAIN_IMAGE_TAG=5.1.x-569-g7621eb8827
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@github-actions

github-actions Bot commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

/konflux-retest create-custom-snapshot

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

2 similar comments
@github-actions

github-actions Bot commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

/konflux-retest create-custom-snapshot

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@github-actions

github-actions Bot commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

/konflux-retest create-custom-snapshot

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

ai-assisted area/central

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

@dashrews78
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.