Skip to content

fix: class_defaults permissions use wrong field names (allow/deny vs a/d) - #5

Merged
bluecords merged 1 commit into
mainfrom
fix/class-default-permission-field-names
Jul 5, 2026
Merged

fix: class_defaults permissions use wrong field names (allow/deny vs a/d)#5
bluecords merged 1 commit into
mainfrom
fix/class-default-permission-field-names

Conversation

@bluecords

Copy link
Copy Markdown
Owner

Summary

  • The "Role Classes" settings page in nac-web is completely broken - every Save on a class's permissions/max-message-length throws a 422 from the server.
  • Root cause: Server.setClassDefaultPermissions/setClassDefaultMaxMessageLength build each ClassDefault.permissions entry with {allow, deny} keys, but the backend's ClassDefault.permissions field is typed as OverrideField ({a, d}) - the same shape every role's permissions field already uses everywhere else in this SDK. {allow, deny} is the shape for the different Override type used only by the PUT /servers/{id}/permissions/{role_id} endpoint.
  • Confirmed against the live OpenAPI spec: ClassDefault.permissions -> OverrideField (a/d required), DataSetServerRolePermission.permissions -> Override (allow/deny required). These are two distinct schemas with different field-naming conventions, and this code was using the wrong one.

Test plan

  • pnpm typecheck clean
  • Bunjie: retest Save in nac-web Settings > Server > Roles > Role Classes once this ships

…ss_defaults

Server.setClassDefaultPermissions/setClassDefaultMaxMessageLength built
each ClassDefault.permissions entry with {allow, deny} keys, but the
backend's ClassDefault.permissions field is typed as OverrideField
({a, d}) - the same shape every role's permissions already use. The
mismatch caused Rocket to reject the PATCH /servers/{id} body outright
with a 422 before it ever reached application logic, breaking the
"Role Classes" settings save button entirely.
@bluecords
bluecords merged commit 76cd50d into main Jul 5, 2026
@bluecords
bluecords deleted the fix/class-default-permission-field-names branch July 5, 2026 12:53
bluecords added a commit to bluecords/nac-web that referenced this pull request Jul 5, 2026
#93)

The Role Classes settings page was broken end-to-end - saving a class's
permissions or max message length threw a 422, because the SDK built
the request body with {allow, deny} keys where the backend expects
{a, d} (bluecords/javascript-client-sdk#5).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant