fix: allow admins to set app_identity via applications PUT API #1649#1727
Merged
DmytroZaichenkoDev merged 4 commits intoJul 17, 2026
Merged
Conversation
…by admins #1649 The Admin UI creates and edits public-bucket applications through the plain applications PUT API (Core-direct), so admin/apply cannot be the only authoritative channel for app_identity / allow_user_external_services. An admin PUT to the public bucket now honors each field when present in the body (present-as-null/false explicitly revokes) and inherits when absent, so a read-modify-write client can never wipe a grant. app_identity is returned on raw resource reads to admins only - it is verification material (key hash / workload client_id), not a credential; client_secret stripping stays unconditional. Non-admin writes, user-bucket writes, copy/move and publication keep strip/inherit semantics, so grants still cannot exist on user-bucket apps. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
DmytroZaichenkoDev
requested review from
Oleksii-Klimov and
astsiapanay
as code owners
July 16, 2026 13:10
This comment has been minimized.
This comment has been minimized.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
astsiapanay
reviewed
Jul 16, 2026
…ction into the record #1649 Addresses review: class name must be a noun, 'write' argument renamed to 'mode', admin-public-write presence logic moved to a factory on the record. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
astsiapanay
approved these changes
Jul 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Admin PUT to the public bucket is now authoritative for the admin-managed application fields (
app_identity,allow_user_external_services), andapp_identitybecomes readable on raw resource GET for admins. This unblocks the Admin UI, which manages public-bucket applications through the plain applications PUT API (Core-direct) and therefore could never grant or display OBO trust with admin/apply as the only authoritative channel.Applicable issues
Description of changes
AdminManagedFieldsWriteModeenum with a per-fieldAdminManagedFieldsWritepolicy record: config file / admin-apply honor both fields (unchanged), an admin PUT to the public bucket honors exactly the fields present in the request body, every other write (non-admin, user-bucket, copy/move, publication) honors neither.null/falseis an explicit revoke.app_identityis returned on raw resource reads to admins only — it is verification material (a key hash or workloadclient_id), not a presentable credential;client_secret/code_verifierstripping stays unconditional for all roles. Deployment views and non-admin reads keep stripping it.Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
🤖 Generated with Claude Code