CXP-768 Gate account re-parenting on org/OU sync opt-in#139
CXP-768 Gate account re-parenting on org/OU sync opt-in#139JavierCarnelli-ConductorOne wants to merge 1 commit into
Conversation
accountResourceType.List() re-parented every account onto its Organizations Root/OU whenever organizations:ListParents succeeded, regardless of whether the organization/organizational_unit resource types (OptInRequired, off by default) were actually being synced. In the default orgs+sso configuration this left every account with a parent pointing at a resource that was never synced, and c1 silently drops the reference as a dangling MISSING RESOURCE. Thread cli.ConnectorOpts through New() (previously discarded) to learn whether this sync run will actually emit organization/ organizational_unit, and gate both the ListParents call and the resulting parent attachment on it -- including the resolved parent's specific type, so partial opt-in can't produce a dangling parent either. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Connector PR Review: CXP-768 Gate account re-parenting on org/OU sync opt-inBlocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0 Review SummaryScanned the full PR diff for security and correctness. This threads Security IssuesNone found. Correctness IssuesNone found. SuggestionsNone. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| // actually sync the corresponding (OptInRequired) hierarchy resource type. Account | ||
| // re-parenting (see List) is gated on these so accounts never point at a Root/OU | ||
| // resource that this run never syncs, which would otherwise leave a dangling | ||
| // "MISSING RESOURCE" parent. See CXP-768. |
There was a problem hiding this comment.
delete CXP-768, because it's public repo
|
Adjacent edge not addressed: the OU→Root parent edge (organizationalUnitResource → WithParentResourceID) has the same dangling shape if organizational_unit is synced while organization (Root) isn't. In practice the OU crawl is seeded from the Root, so "OU without org" is likely unreachable — but if that invariant changes, the same MISSING RESOURCE could reappear one tier up. Note on the ticket. Could you confirm with |
2 participants
accountResourceType.List() re-parented every account onto its Organizations Root/OU whenever organizations:ListParents succeeded, regardless of whether the organization/organizational_unit resource types (OptInRequired, off by default) were actually being synced. In the default orgs+sso configuration this left every account with a parent pointing at a resource that was never synced, and c1 silently drops the reference as a dangling MISSING RESOURCE.
Thread cli.ConnectorOpts through New() (previously discarded) to learn whether this sync run will actually emit organization/ organizational_unit, and gate both the ListParents call and the resulting parent attachment on it -- including the resolved parent's specific type, so partial opt-in can't produce a dangling parent either.