Skip to content

feat: add entity_type field to all 5 authz policy types#984

Merged
pyramation merged 1 commit intomainfrom
devin/1776335627-entity-type-authz-field
Apr 16, 2026
Merged

feat: add entity_type field to all 5 authz policy types#984
pyramation merged 1 commit intomainfrom
devin/1776335627-entity-type-authz-field

Conversation

@pyramation
Copy link
Copy Markdown
Contributor

Summary

Adds a new entity_type string property to the parameter_schema of all 5 authz node type definitions in the node-type-registry:

  • AuthzMembership
  • AuthzEntityMembership
  • AuthzRelatedEntityMembership
  • AuthzPeerOwnership
  • AuthzRelatedPeerOwnership

This lets policy definitions use entity_type: 'channel' (the entity prefix string) instead of membership_type: 3 (a hardcoded integer that depends on provisioning order). The RLS parser resolves the prefix to the correct membership_type integer via memberships_module lookup at parse time.

For AuthzMembership, the required array is changed from ["membership_type"] to [] — either membership_type or entity_type must be provided, but this is now validated server-side in parse.sql rather than by the JSON schema.

Companion to constructive-db PR #816 which implements the actual parse_policy_sprt_entity_type() resolution function.

Review & Testing Checklist for Human

  • required: [] on AuthzMembership — Previously membership_type was required by the schema. Now neither field is required at the schema level; validation is deferred to the server (parse.sql checks IF membership_type IS NULL AND entity_type IS NULL). Verify no client-side code relies on this schema validation to catch missing fields before they reach the server.
  • Merge ordering — constructive-db PR feat: pass schema naming strategy env vars to pgSettings #816 must be deployed before anyone uses entity_type in a policy node, otherwise the RLS parser won't recognize the field. Confirm the deployment sequence.
  • Generated code — If the node-type-registry schemas feed into downstream codegen (e.g. pnpm generate:types), regenerated output may need updating in a follow-up. Check whether the seed SQL in constructive-db also needs regeneration to reflect these schema changes.

Notes

  • The 4 other authz types (AuthzEntityMembership, AuthzRelatedEntityMembership, AuthzPeerOwnership, AuthzRelatedPeerOwnership) already had membership_type as optional in their required arrays, so adding entity_type there is purely additive with no validation behavior change.
  • No runtime logic changes — these are static JSON schema definitions only.

Link to Devin session: https://app.devin.ai/sessions/61be2d8e471048e294178e4a95d7e9dc
Requested by: @pyramation

Add entity_type string property to AuthzMembership, AuthzEntityMembership,
AuthzRelatedEntityMembership, AuthzPeerOwnership, and AuthzRelatedPeerOwnership.

This allows policy definitions to use entity_type: 'channel' instead of
membership_type: 3. The RLS parser resolves the prefix to the correct
membership_type integer via memberships_module lookup.

For AuthzMembership, required fields updated: either membership_type or
entity_type must be provided (validated server-side in parse.sql).

Companion to constructive-db PR #816.
@devin-ai-integration
Copy link
Copy Markdown
Contributor

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment and CI monitoring

@pyramation pyramation merged commit 9dda167 into main Apr 16, 2026
49 checks passed
@pyramation pyramation deleted the devin/1776335627-entity-type-authz-field branch April 16, 2026 19:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant