Repository navigation
feat(cli): add access-requests revoke and the revoked grant state (ALIEN-1135) - #820
Conversation
…IEN-1135)
Regenerate the Platform API spec copies and SDKs from the Platform API
that adds POST /v1/access-requests/{id}/revoke, GET /{id}/activity, the
revoked status, the per-request decision records and the command link.
alien access-requests revoke <id> [--reason] withdraws a request; wait
treats a revoked request as closed. The CRD status description lists
REVOKED, which the operator writes when the control plane revokes a
grant.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1666b0f058
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…revoke change The Platform TypeScript SDK is regenerated by generate:platform-api with its pinned Speakeasy version, and nothing in this change consumes it, so it goes back to its state on main. The spec copies and the Rust client inputs stay. The refreshed spec no longer has an Azure catalogImage on the Remote Sandbox settings, so the Rust decode test stops asserting on that field.
…ctivity client get --json adds agentSessionId, createdAt, queuedBy, queuedAt, approvedBy, deniedBy and revokedBy; revoke --json prints the whole response, as wait --json does. get also prints who revoked a request and why. No Rust consumer calls getAccessRequestActivity, so it leaves the filtered client's operation list.
Two descriptions changed: the debug-session access request link and the revoked request ids the operator pulls.
|
@greptile review |
1 participant
Implements the CLI side of ALIEN-1135. Merge this first; the Platform API change depends on it.
What changes for the user
alien access-requests revoke <id> [--reason <text>]withdraws a pending, queued or approved request. Operations still waiting to be dispatched fail, open debug sessions stop, and operations already running finish. Revoking twice returns the same request. An expired or rejected request is refused with the API'sACCESS_REQUEST_NOT_REVOCABLEmessage.alien access-requests waitand the--request-accessshortcuts treat a revoked request as closed, the same as rejected or expired.get --jsonaddsagentSessionId,createdAt,queuedBy,queuedAt,approvedBy,deniedByandrevokedBy.revoke --jsonprints the whole API response, aswait --jsonalready does.getandrevokeprint who revoked a request and why.status.statedescription listsREVOKED. The control plane's loop writes it when a grant is revoked; the OSS operator still never acts on the CR status.What the next maintainer inherits
client-sdks/platform/openapi.json,rust/openapi.jsonandrust/openapi-3.0.jsonare the current Platform API contract, copied by the Platform API generation pipeline. Nothing is hand-edited. Besides the revoke and activity operations, the copy brings the spec up to date in five operations and three schemas. One of those removescatalogImagefrom the Azure half of the Remote Sandbox settings, sotests/remote_sandbox_azure_registry_image.rsno longer asserts on that field.main, and nothing in this change uses it. Regenerating it withpnpm run generate:platform-api(Speakeasy 1.799.0) belongs in its own SDK-sync PR, asclient-sdks/AGENTS.mdasks.REQUIRED_OPERATION_IDSgainsrevokeAccessRequestonly.getAccessRequestActivityhas no Rust consumer in this repository, so it stays out of the filtered client. The filtered client is about 214,000 lines, underMAX_FILTERED_GENERATED_LINES.AccessRequestStatus::Revokedis in the generated enum. An older CLI fails closed decoding it ingetandwait.crates/alien-cli/src/commands/access_requests.rs:approval_outcome()decides whether a status is approved, closed or pending.wait,wait_for_approvalandoperations invoke --request-accessall use it.Verification
cargo test -p alien-platform-api: the filter keeps exactly the listed operations, and the Remote Sandbox and unknown-field decode tests pass against the new spec.cargo test -p alien-cli --lib access_requests:revokeparses with and without--reason; against a loopback API it sends{ "reason": … }or{}with the workspace, accepts arevokedresponse, and surfaces the API message on 404 and 409;approval_outcomeis checked for every status.cargo fmt --check.