feat: GeonicDB サーバー週次アップデート対応 (2026-03-13~20)#79
Merged
Conversation
- API キーに --permissions オプション追加 (GeonicDB #753) - write:X implies read:X 暗黙包含の削除をヘルプに反映 (GeonicDB #723) - テナント anonymous-access フラグ削除 (GeonicDB #752) - policies ヘルプに servicePath, priority, デフォルトポリシー情報追加
📝 WalkthroughWalkthroughCLIに Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@CHANGELOG.md`:
- Line 15: The CHANGELOG entry "**Docs**: README を更新 — `--permissions`
オプション、XACML 認可モデル、スコープ包含関係、API キーヘッダ排他仕様を反映" is missing the PR number suffix;
update that line to append the PR reference " (`#79`)" (or the project’s preferred
suffix format) so it follows the project's guideline of including PR numbers on
CHANGELOG entries.
In `@src/commands/admin/api-keys.ts`:
- Around line 48-49: The permissions handling currently just splits
opts.permissions into payload.permissions allowing empty arrays or invalid
entries; update the logic where payload.permissions is set (uses
opts.permissions and payload.permissions) to validate and normalize values:
after splitting and trimming, filter out empty strings, ensure each permission
is in the allowed permission set (define or import the canonical list used by
create/update), and if any invalid entries exist, abort with a user-facing error
message instead of sending them to the API; apply the same
validation/normalization in the other places mentioned (the occurrences around
the blocks that set payload.permissions at the other two spots) so CLI-side
validation rejects or corrects empty/invalid permission values before submitting
create/update.
- Line 218: The CLI defines a global option "--permissions <perms>" but only the
"create" subcommand shows the permissions help text; add the same permissions
notes to the "update" subcommand so users see the comma-separated permissions
explanation for both. Locate the "--permissions <perms>" option registration and
the help/notes block used for the "create" command, then copy or reference that
permissions description into the "update" command's help/notes (the "create" and
"update" subcommand handlers/definitions) so both commands display identical
permission guidance.
In `@src/commands/me-api-keys.ts`:
- Around line 71-79: The permissions parsing currently builds
payload.permissions from opts.permissions without validating resulting values;
update the block that handles opts.permissions (where payload.permissions is
set) to validate after splitting and trimming: if opts.permissions is an empty
string or the split/trim/filter result is an empty array, surface a CLI error
(throw/console.error + process.exit(1) or return) and do not set
payload.permissions; additionally validate each permission token against the
canonical allowed-permissions set (use the existing permission constants or add
a small whitelist) and reject any unknown values with a clear error message so
`--permissions ""` and invalid tokens are rejected like origins.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 1a5b8330-9df6-4409-a139-c1e5e223c3f1
📒 Files selected for processing (10)
CHANGELOG.mdREADME.mdsrc/commands/admin/api-keys.tssrc/commands/admin/policies.tssrc/commands/admin/tenants.tssrc/commands/me-api-keys.tssrc/helpers.tstests/admin-api-keys.test.tstests/admin-tenants.test.tstests/me-api-keys.test.ts
There was a problem hiding this comment.
♻️ Duplicate comments (1)
src/commands/admin/api-keys.ts (1)
48-49:⚠️ Potential issue | 🟠 Major
--permissions ""が無視され、バリデーションを迂回できます。
opts.permissionsを truthy で判定しているため、空文字を明示指定したケースでparsePermissions()が実行されません。結果として入力が無視され、create/update で意図しない JSON 入力経路に入ります。undefined判定に揃えてください。修正案
- if (opts.permissions) payload.permissions = parsePermissions(opts.permissions as string); + if (opts.permissions !== undefined) payload.permissions = parsePermissions(String(opts.permissions)); - } else if (opts.name || opts.scopes || opts.origins || opts.entityTypes || opts.rateLimit || opts.dpopRequired !== undefined || opts.permissions || opts.tenantId) { + } else if (opts.name || opts.scopes || opts.origins || opts.entityTypes || opts.rateLimit || opts.dpopRequired !== undefined || opts.permissions !== undefined || opts.tenantId) { - } else if (opts.name || opts.scopes || opts.origins || opts.entityTypes || opts.rateLimit || opts.dpopRequired !== undefined || opts.permissions) { + } else if (opts.name || opts.scopes || opts.origins || opts.entityTypes || opts.rateLimit || opts.dpopRequired !== undefined || opts.permissions !== undefined) {Also applies to: 143-144, 237-238
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/commands/admin/api-keys.ts` around lines 48 - 49, The code currently guards assignment with a truthy check which causes an explicit empty string (--permissions "") to be ignored; change the conditional checks that set payload.permissions from using truthiness (opts.permissions) to explicit undefined checks (opts.permissions !== undefined) so parsePermissions(opts.permissions as string) is called for empty string inputs; update the three locations that perform this pattern (the places that set payload.permissions using parsePermissions, e.g., inside the API key create/update handlers where opts.permissions and payload.permissions are referenced) to use the undefined check instead of a truthy check.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@src/commands/admin/api-keys.ts`:
- Around line 48-49: The code currently guards assignment with a truthy check
which causes an explicit empty string (--permissions "") to be ignored; change
the conditional checks that set payload.permissions from using truthiness
(opts.permissions) to explicit undefined checks (opts.permissions !== undefined)
so parsePermissions(opts.permissions as string) is called for empty string
inputs; update the three locations that perform this pattern (the places that
set payload.permissions using parsePermissions, e.g., inside the API key
create/update handlers where opts.permissions and payload.permissions are
referenced) to use the undefined check instead of a truthy check.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ed30ca1d-1219-46e4-b713-d1a450941fce
📒 Files selected for processing (7)
CHANGELOG.mdsrc/commands/admin/api-keys.tssrc/commands/me-api-keys.tssrc/helpers.tstests/admin-api-keys.test.tstests/helpers.test.tstests/me-api-keys.test.ts
🚧 Files skipped from review as they are similar to previous changes (5)
- CHANGELOG.md
- tests/admin-api-keys.test.ts
- tests/me-api-keys.test.ts
- src/helpers.ts
- src/commands/me-api-keys.ts
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@CHANGELOG.md`:
- Around line 146-148: Update the changelog links: change the compare range
referenced by the link label [0.7.0] from v0.6.4...v0.7.0 to v0.6.3...v0.7.0
(adjust the URL/compare range accordingly) and remove the unused/invalid link
label [0.6.4] entirely so there is no reference to a non-existent v0.6.4 tag.
Comment on lines
+146
to
+148
| [Unreleased]: https://github.com/geolonia/geonicdb-cli/compare/v0.7.0...HEAD | ||
| [0.7.0]: https://github.com/geolonia/geonicdb-cli/compare/v0.6.4...v0.7.0 | ||
| [0.6.4]: https://github.com/geolonia/geonicdb-cli/compare/v0.6.3...v0.6.4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: v0.6.4 タグの存在を確認
# v0.6.4 タグが存在するか確認
if git tag | grep -q "^v0.6.4$"; then
echo "✓ v0.6.4 タグが存在します"
git log --oneline v0.6.3..v0.6.4
else
echo "✗ v0.6.4 タグは存在しません"
fi
# 最新のタグを表示
echo ""
echo "最新のバージョンタグ:"
git tag --sort=-version:refname | head -n 5Repository: geolonia/geonicdb-cli
Length of output: 96
🏁 Script executed:
# Check the current state of CHANGELOG.md lines around 146-148
wc -l CHANGELOG.mdRepository: geolonia/geonicdb-cli
Length of output: 81
🏁 Script executed:
# Read the end of CHANGELOG.md to see the link definitions
tail -20 CHANGELOG.mdRepository: geolonia/geonicdb-cli
Length of output: 1222
🏁 Script executed:
# Search for [0.6.4] section in the entire CHANGELOG.md
grep -n "\[0\.6\.4\]" CHANGELOG.mdRepository: geolonia/geonicdb-cli
Length of output: 142
** версия 0.6.4 のリンク定義が無効です。v0.6.4 タグが存在しないため削除してください。**
Git リポジトリに v0.6.4 タグが存在しません。以下の対応が必要です：
- 147 行目：
[0.7.0]の比較リンクをv0.6.4...v0.7.0からv0.6.3...v0.7.0に修正 - 148 行目：
[0.6.4]のリンク定義を削除
修正内容（CHANGELOG.md 147-148 行目）
[Unreleased]: https://github.com/geolonia/geonicdb-cli/compare/v0.7.0...HEAD
-[0.7.0]: https://github.com/geolonia/geonicdb-cli/compare/v0.6.4...v0.7.0
-[0.6.4]: https://github.com/geolonia/geonicdb-cli/compare/v0.6.3...v0.6.4
+[0.7.0]: https://github.com/geolonia/geonicdb-cli/compare/v0.6.3...v0.7.0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| [Unreleased]: https://github.com/geolonia/geonicdb-cli/compare/v0.7.0...HEAD | |
| [0.7.0]: https://github.com/geolonia/geonicdb-cli/compare/v0.6.4...v0.7.0 | |
| [0.6.4]: https://github.com/geolonia/geonicdb-cli/compare/v0.6.3...v0.6.4 | |
| [Unreleased]: https://github.com/geolonia/geonicdb-cli/compare/v0.7.0...HEAD | |
| [0.7.0]: https://github.com/geolonia/geonicdb-cli/compare/v0.6.3...v0.7.0 |
🧰 Tools
🪛 markdownlint-cli2 (0.21.0)
[warning] 148-148: Link and image reference definitions should be needed
Unused link or image reference definition: "0.6.4"
(MD053, link-image-reference-definitions)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@CHANGELOG.md` around lines 146 - 148, Update the changelog links: change the
compare range referenced by the link label [0.7.0] from v0.6.4...v0.7.0 to
v0.6.3...v0.7.0 (adjust the URL/compare range accordingly) and remove the
unused/invalid link label [0.6.4] entirely so there is no reference to a
non-existent v0.6.4 tag.
This was referenced Mar 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GeonicDB サーバーの過去1週間の変更 (2026-03-13〜20) に CLI を追従させる。
admin api-keys create/updateおよびme api-keys createに--permissionsオプション追加 —read,write,create,update,deleteを指定して XACML ポリシーを自動生成 (GeonicDB #753)admin tenants updateから--anonymous-access/--no-anonymous-accessフラグを削除 — テナントフィーチャーフラグ廃止に伴い、匿名アクセスは XACML ポリシーで制御する方式に変更 (GeonicDB #752)write:X implies read:Xの記述を削除 —write:Xはread:Xを暗黙的に含まなくなった (GeonicDB #723)admin policies createのヘルプにservicePathリソース属性、priority の説明（大きい数値=高優先度）、デフォルトロールポリシーの説明を追加 (GeonicDB #747, #751, #752)Server PRs referenced
Test plan
npm run lint— cleannpm run typecheck— cleannpm test— 629 tests passed (33 files)--permissionsフラグのユニットテスト追加 (admin api-keys create/update, me api-keys create)Summary by CodeRabbit
新機能
重大な変更
write:Xはread:Xを暗黙に含まない。ドキュメント