Repository navigation
Entitlements: Kind on the entitlement reference, provider Kind validation (#289) - #351
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…eEntitlement (#289) - AD supports Kind 'Group' only. Grant/Revoke/Resolve no longer resolve any Kind as a group, and ListEntitlements accepts and validates Kind. - Entra ID supports 'Group' and 'AdministrativeUnit'. ListEntitlements throws for other Kinds instead of returning nothing; the bulk methods validate all entries before changing any membership; unreachable "default to Group" branches removed. - Kind is returned in canonical casing. - ResolveEntitlement(Entitlement[, AuthSession]) takes the Kind from the entitlement; the unused Kind parameter is removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PruneEntitlements and PruneEntitlementsEnsureKeep apply With.Kind to Keep entries. An explicit Keep[].Kind must match With.Kind; a different Kind fails the step before anything is listed or changed (it was matched by Id only and granted with the foreign Kind by EnsureKeep). Step help and examples omit the redundant Keep[].Kind. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… resolvers (#289) - IdLE.Entitlement.List resolvers accept an optional With.Kind. It is passed to ListEntitlements when the provider declares Kind (Entra ID then skips Administrative Unit calls and their Graph permissions), and the result is always filtered to that Kind. - A second resolver for the same capability, provider and auth session fails instead of silently replacing the first result. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…#289) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
) - docs/extend/providers.md: entitlement provider contract (methods, supported Kinds per provider, ResolveEntitlement migration). - Context resolver docs and capability reference: With.Kind for IdLE.Entitlement.List, one resolver per capability/provider/session. - Provider references: supported Kinds; Entra ID resolver permissions note. - Regenerated step and cmdlet references. - Remove the design document. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Test-IdleWorkflow now rejects a resolver With.Kind that is not a non-empty string or is used with a capability other than IdLE.Entitlement.List, instead of failing only at planning (wrapped as a provider error) or being ignored. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
blindzero
added this to the
v1.0.0 - Stable Contracts & Finishing for the release milestone
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Verdict: PASS — no blocking issues; Kind validation, prune-scope inheritance and resolver dedup are consistent with AGENTS.md and the linked issue. No CRITICAL, MAJOR or MINOR findings. Tests, docs, regenerated references and breaking-change notes are included in the PR. |
Code Coverage Report
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
An entitlement is identified by
Kind+Id.Kindnow belongs to the entitlement reference; a step-level Kind only defines a scope (what a prune may remove, what a resolver lists). Providers own their supported Kinds and reject everything else before changing anything. The design was folded intodocs/extend/providers.md(section Entitlement providers), the step help and the context resolver docs.Steps
IdLE.Step.EnsureEntitlement: unchanged (With.Entitlement.Kind, one entitlement per step).IdLE.Step.PruneEntitlements/PruneEntitlementsEnsureKeep:With.Kindstays required as the prune scope.Keep[].Kindis optional and inheritsWith.Kind; a different Kind fails the step before anything is listed or changed. Previously such an entry was matched byIdonly and EnsureKeep granted it with the foreign Kind.Providers
Grouponly. Grant, Revoke and Resolve no longer treat every Kind as a group (anAdministrativeUnitentitlementSalesadded the user to a groupSales).ListEntitlementsaccepts and validatesKind, so a prune with an unsupported Kind fails instead of silently removing nothing.GroupandAdministrativeUnit.ListEntitlementsthrows for other Kinds (e.g.'Groups') instead of returning nothing. The bulk methods validate all entries before changing any membership. Unreachable "default to Group" branches were removed.ResolveEntitlement(Entitlement[, AuthSession]): the unusedKindparameter is removed.Context resolvers
IdLE.Entitlement.Listaccepts an optionalWith.Kind. It is passed toListEntitlementswhen the provider declaresKind, and the result is always filtered to it. Entra ID then skips Administrative Unit calls, so group-only workflows no longer needAdministrativeUnit.Read.All(the provider docs claimed this before, but it only held for steps).With.Kindis validated by the workflow schema (non-empty string, only forIdLE.Entitlement.List).Examples / docs
Keep[].Kind; the mock resolver example showsWith.Kind.providers.md,context-resolver.md,capabilities.md, AD / Entra ID / Mock provider references; step and cmdlet references regenerated.Breaking changes
No compatibility layer, as for #324.
Keep[].Kinddifferent fromWith.Kindfails; use one prune step per Kind.ResolveEntitlement($Kind, $Entitlement, $AuthSession)becomesResolveEntitlement($Entitlement, $AuthSession).Not included
Plan-time Kind validation (providers declaring their Kinds) is deferred to after v1.0; it can be added as an optional provider method without breaking this contract.
Testing
AdministrativeUnitinstead of resolving a group; AD prune with an unsupported Kind fails without changes; Entra IDListEntitlementswith a misspelled Kind; Entra ID bulk methods with an unsupported Kind change nothing; duplicate resolvers.With.Kind(including EnsureKeep grants);ResolveEntitlementreceives only the entitlement; canonical Kind casing; resolverWith.Kindwith and without a providerKindparameter; resolver Kind schema validation../tools/Invoke-IdlePesterTests.ps1: 1092 passed, 0 failed../tools/Invoke-IdleScriptAnalyzer.ps1: no findings../tools/Test-DocsConsistency.ps1: PASS.Closes #289
🤖 Generated with Claude Code