Guard role grant emission behind WillSyncResourceType#31
Conversation
userResourceType.Grants() emits role grants as a sync optimization
(the user API response already includes role membership), but did so
unconditionally. When a customer's sync filter excludes roles, the
connector still emitted grants referencing an unsynced resource type.
Gate the emission on cli.ConnectorOpts.WillSyncResourceType("role"),
threaded from NewLambdaConnector through the Connector struct into the
user builder. Also mark the user resource type with
SkipEntitlementsAndGrants when roles aren't synced, since the user
builder has no entitlements/grants of its own otherwise.
Follows the pattern from ConductorOne/baton-linear#55.
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Connector PR Review: Guard role grant emission behind WillSyncResourceTypeBlocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0 Review SummaryScanned the full PR diff for security and correctness. The change gates the user builder's cross-type Security IssuesNone found. Correctness IssuesNone found. SuggestionsNone. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
1 participant
Summary
userResourceType.Grants()(pkg/connector/users.go) emitsrolegrants as a sync optimization since the JumpCloud user API response already includes the admin user's role — but it did so unconditionally, even when a customer's sync filter excludes theroleresource type.cli.ConnectorOpts.WillSyncResourceType("role"), threaded fromNewLambdaConnector→Connector.syncRoles→newUserBuilder.NewLambdaConnectoralready received*cli.ConnectorOptsbut never used it.SkipEntitlementsAndGrants(the user builder has no entitlements/grants of its own besides the gated role grants).Test plan
go build ./...go test ./...pkg/connector/users_test.go:TestUserGrants_RoleSyncFilter— asserts no grants (and no API call) when roles are filtered out, and a correct role grant when roles are synced (via anhttptest.Servermocking the JumpCloud user-get endpoint).TestNewUserBuilder_ResourceTypeAnnotations— assertsSkipEntitlementsAndGrantsis set on the user resource type only when roles are filtered out.Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com