Repository navigation
feat(client)!: native editing through the host proxy (slice 2) - #61
Merged
Merged
Conversation
The store now treats metadata.managedFields and the last-applied-configuration annotation like redacted paths, whatever the policy: the same two paths ValidateMergePatch refuses for every projection. A native object carries both, so this is what lets the default policy edit it. A map that holds a protected path is merged and edited key by key rather than replaced whole. That also fixes a new Secret data key beside redacted values, which was accepted but never reached changes() or patch(). BREAKING CHANGE: setValue and removeKey on metadata.annotations as a whole are refused; edit each annotation key instead. isEditable on that map is now false. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Builds the object URL under the same proxy and collection a native watch reads, for a native editor's conditional PATCH and guarded recovery read. Shares segment validation with nativeCollectionURL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ValidateNativeMergePatch refuses a patch without metadata.uid and metadata.resourceVersion preconditions, or one touching managedFields or the last-applied annotation, including through a parent. A host proxy runs it before forwarding a native write. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…eal-API checks examples/native-editor/editor.ts sends the captured intent as a JSON merge PATCH with its UID and resourceVersion through the watched proxy, and recovers a 409 through a guarded native GET. The real-API case runs it and the connector through a /k8s proxy that validates each PATCH: a save and its echo, a competing write between capture and PATCH, refused unconditional and machinery patches, and a same-name replacement. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 54 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (30)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…ed read A network failure or 5xx left the native editor free to send the same PATCH again, and an accepted write whose echo never arrived let a second Save write again too. The editor now owes a guarded read in both cases: the next Save reads instead of writing, and confirm() performs that read when the host stops waiting for an echo. A 4xx is a definite refusal and owes none. The write response is still never adopted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sunib
added this pull request to stack #56
October 5, 2026 12:20
# Conflicts: # packages/krm-stream/src/url.ts # packages/krm-stream/test/native.test.ts
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Slice 2 of the native work: editing objects read with
connectNativeWatch, written back through the same host proxy. Stacked on #60 (feat/native-watch-viewer); retarget tomainonce #59 and #60 merge.What it adds
metadata.managedFieldsand thekubectl.kubernetes.io/last-applied-configurationannotation are protected the way redacted paths are. These are the same two pathsValidateMergePatchalready refuses for every projection. No new policy or store is needed:new LiveResourceStore()edits native objects.datakey added beside redacted values was accepted but never reachedchanges()orpatch().nativeObjectURL(proxy, scope)addresses one member under the same proxy and collection the watch reads.gateway.ValidateNativeMergePatch(patch)is for a host proxy to run before forwarding a native PATCH. It refuses a patch without bothmetadata.uidandmetadata.resourceVersion, or one that touches machinery, including through a parent such asannotations: null.examples/native-editor/editor.tsis a copyable conditional editor:application/merge-patch+jsonwith the preconditions inside the patch.metadata.uid, it reconciles a guarded native GET of the same object.saving.mdhas a native editing section comparing the projected and native write contracts.migrating.mdlists the edit-policy change.No editor method changed, so proposal 0009's cleanup is unaffected. Gateway v1 wire and protocol version are unchanged.
Breaking change
setValueandremoveKeyonmetadata.annotationsas a whole are refused; edit each annotation key instead.isEditable(uid, ["metadata", "annotations"])is nowfalse, whileisDirtyon it still reports edits underneath.Validation
task fixtures-checktask testtask linttask build-client/task pack-clientnativeObjectURLis in the bundle and the declarationstask e2e-wiretask e2e-browsertask test-real-apiv1.36.4+k3s1, including the newTestRealAPINativeEditThroughHostProxyThe new real-API case drives the real connector and editor through a credential-holding
/k8sproxy that validates each PATCH. It checks:unavailablewith the replacement untouched.I repeated it 8 times with
-race; it passed every time, recovering withversion-stalethensaved.Not run:
task release-rehearsal,task test-clusterandtask cluster-facts, which this change doesn't need. There is no browser page for native editing yet; the comparative frontend (order 6) is where one belongs.🤖 Generated with Claude Code