2.6 KiB
todo
Scoring
Score = 100 * V / (2**S + 8)
Bar = 1
Next ID = 63
Items
| ID | Release | Blocked by | Exempt | Item | L | E | I | R | S | Moves | Score |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 62 | 0.5.1 | Delete a group's grants and its membership set in one Keto transaction, so a failure cannot leave it half-deleted. | 1 | 2 | 2 | 3 | 2 | code health by 2, 2 by 3 | 16.2 | ||
| 19 | 0.6.0 | question | Run the documented Docker commands on macOS and fix whatever misbehaves. | 2 | 2 | 1 | 3 | 3 | 1 by 3 | 3.3 | |
| 16 | 0.6.0 | question | Decide whether the single Keto Resource namespace splits into per-domain namespaces. |
3 | 2 | 3 | 6 | 6 | 7 by 2 | 0.5 | |
| 14 | 0.6.0 | Drop a double-clicked duplicate submit, with no client-side JavaScript. | 4 | 2 | 3 | 7 | 7 | 2 by 7, 1 by 4 | 1.4 |
Renamed
- 0.4.21 renamed to 0.5.0
- 0.4.22 renamed to 0.5.0
Details
62. Delete a group's grants and its membership set in one Keto transaction, so a failure cannot leave it half-deleted.
groupsDelete in examples/plugins/auth-admin/admin-groups.ts drops each held grant with its own
deleteTuple, then the membership tuple, so a Keto failure part-way leaves a group with some grants
gone and its members still listed. Send all the deletes through KetoClient.transactTuples, as
applyGrants in admin-grants.ts does. The comment on delete order stays true inside one
transaction.
19. Run the documented Docker commands on macOS and fix whatever misbehaves.
Needs a Mac. Two suspects, both from --user "$(id -u):$(id -g)": a macOS id -g is 20, which is
dialout inside the noble image, and Docker Desktop remaps bind-mount ownership in its VM.
16. Decide whether the single Keto Resource namespace splits into per-domain namespaces.
Ory's own examples model Shift, Document and so on. One global Resource bucket is the
project's "no catch-all names" rule applied to namespaces.
14. Drop a double-clicked duplicate submit, with no client-side JavaScript.
A second identical POST is expected from a non-technical user, and today creates two users, mints two recovery codes, or registers two OAuth2 clients. It must not break a legitimately repeatable action. Sketch: a CSS-only affordance so the second click has nothing to hit, plus the host recognising a duplicate (same session, route and payload within a short window), logging and dropping it. Open: what identifies "the same submission" (a one-time token minted into each form beats hashing the payload), the window, where the record lives given the host is stateless, and how a plugin declares a route repeatable.