direct: Fix permissions state path to match input config schema#4703

Merged

denik merged 93 commits intomainfrom

denik/permissions-reference

Mar 17, 2026

Commits on Mar 17, 2026

Add implementation plan for __EMBED__ convention in struct walkers

denik
and
claude
committed
Add EmbedTagName constant and IsEmbed() method to structtag

denik
and
claude
committed
Support __EMBED__ tag in structwalk.Walk

denik
and
claude
committed
Support __EMBED__ tag in structwalk.WalkType

denik
and
claude
committed
Support __EMBED__ tag in structaccess.Get

denik
and
claude
committed
Support __EMBED__ tag in structaccess.Set

denik
and
claude
committed
Support __EMBED__ tag in structaccess.ValidatePath

denik
and
claude
committed
Support __EMBED__ tag in structdiff.GetStructDiff

denik
and
claude
committed
Use __EMBED__ tag on PermissionsState.Permissions

denik
and
claude
committed
Enable direct engine for job_permissions acceptance test

denik
and
claude
committed
Regenerate out.test.toml for job_permissions test

denik
and
claude
committed
Add custom JSON marshaling for PermissionsState and regenerate outputs

denik
and
claude
committed
add REQUEST / RESPOSNE
denik
committed
move into TASKS
denik
committed
Add task 002 and claude log

denik
and
claude
committed
Add plan for task 002: refine __EMBED__ convention

denik
and
claude
committed
Switch embed detection from json tag to field name

denik
and
claude
committed
Rename Permissions to EmbeddedSlice, remove custom JSON marshaling

denik
and
claude
committed
Fix formatting after pre-commit hook

denik
and
claude
committed
Fix trailing whitespace in TASKS/001.md

denik
and
claude
committed
Add status for task 002

denik
and
claude
committed
Add PR title and description

denik
and
claude
committed
Update PR title and description

denik
and
claude
committed
Add changelog entry for permissions state path fix

denik
and
claude
committed
Add PR link to changelog entry

denik
and
claude
committed
clean up TASKS
denik
committed
rename field to _
denik
committed
update after rebase
denik
committed
Remove duplicate changelog entry

denik
and
claude
committed
Move EmbeddedSliceFieldName from structtag to structaccess

denik
and
claude
committed
Revert "clean up TASKS"
denik
committed
Add task 004: acceptance tests for permission references
denik
committed
Add plan for task 004: acceptance tests for permission references
denik
committed
Fix reference resolution for permission sub-resources
denik
committed
Add acceptance test for permission reference resolution
denik
committed
Fix trailing whitespace in TASKS/004.md
denik
committed
Simplify permission_ref test: plan + deploy without request recording
denik
committed
Update status and PR description for task 004
denik
committed
Add task 005: use bundle config Permission type in PermissionsState
denik
committed
Add plan for task 005: use Permission type in PermissionsState
denik
committed
Use resources.Permission in PermissionsState instead of iam.AccessControlRequest
denik
committed
Update refschema and fix exhaustruct lint for Permission type change
denik
committed
Update acceptance test outputs: permission_level -> level in direct engine state
denik
committed
Add task 005 status and task 006
denik
committed
Add plan for task 006: permission_level → level state migration
denik
committed
Add permission_level → level migration for backward-compatible state deserialization

denik
and
claude
committed
Update refschema output for StatePermission type
denik
committed
Add acceptance test for permission_level → level state migration
denik
committed
Fix exhaustruct lint for StatePermission
denik
committed
Update task 006 status and PR description
denik
committed
Add task 007: state migration for permissions
denik
committed
Add plan for task 007: state migration system
denik
committed
Add state migration system and move permissions migration to dstate/migrate.go
denik
committed
Update migration test to use old v1 state format with permissions key
denik
committed
Update acceptance test output for state version 2 migration
denik
committed
Update generated output: remove permission_level from StatePermission
denik
committed
Handle state_version 0 (absent field) as version 1 in migration
denik
committed
Update acceptance test outputs for state_version 2
denik
committed
Update task 007 status and PR description
denik
committed
clean up
denik
committed
Move embedded state fixture to separate file in permission_level_migration test

denik
and
claude
committed
update cloud tests
denik
committed
clean up TASKS
denik
committed
Reuse dresources.PermissionsState in dstate migration instead of local duplicates

denik
and
claude
committed
Add job_permission_ref invariant test; separate stderr in plan commands

denik
and
claude
committed
fix out
denik
committed
Exclude job_permission_ref from migrate invariant test

denik
and
claude
committed
Add job_cross_resource_ref invariant test; improve migrate exclusion comment

denik
and
claude
committed
update out.test.toml
denik
committed
Add continuity invariant test for state migration from v0.293.0

denik
and
claude
committed
Replace continuity test with continue_293 that deploys with v0.293.0 CLI at test time

denik
and
claude
committed
Exclude permission ref configs from cloud runs in no_drift test

denik
and
claude
committed
Use built-in groups (users, admins) in permission ref invariant configs

denik
and
claude
committed
record version, remove unnecessary trace
denik
committed
Fix continue_293 exclusion comment: permissions cross-refs require feature not in v0.293.0

denik
and
claude
committed
Add job_with_permissions invariant config; test state migration continuity

denik
and
claude
committed
Clean up unnecessary changes: restore comments, simplify intermediate variable

denik
and
claude
committed
Error on state version newer than supported instead of silently skipping

denik
and
claude
committed
Remove migrate_test.go; migration is covered by acceptance/bundle/state/permission_level_migration

denik
and
claude
committed
Add acceptance test for future state version error

denik
and
claude
committed
Exclude permissions and grants from parent resource walk in refschema

denik
and
claude
committed
normalize NEXT_CHANGELOG
denik
committed
update NEXT_CHANGELOG
denik
committed
update tests
denik
committed
Cache EmbeddedSlice field index and unify embed field lookup

denik
and
claude
committed
Make continue_293 test as slow
denik
committed
update test output
denik
committed
rename to __embed__
denik
committed
update cloud tests
denik
committed
disable flaky check
denik
committed
add a comment
denik
committed
record result on TF but not on direct where it's flaky
denik
committed
restore NEXT_CHANGELOG
denik
committed