54 lines
2.6 KiB
Markdown
54 lines
2.6 KiB
Markdown
# todo
|
|
|
|
## Scoring
|
|
|
|
`Score = 100 * V / (2**S + 8)`
|
|
|
|
`Bar = 1`
|
|
|
|
`Next ID = 63`
|
|
|
|
## Items
|
|
|
|
| ID | Release | Blocked by | Exempt | Item | L | E | I | R | S | Moves | Score |
|
|
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
| 62 | 0.5.1 | | | **Delete a group's grants and its membership set in one Keto transaction, so a failure cannot leave it half-deleted.** | 1 | 2 | 2 | 3 | 2 | code health by 2, 2 by 3 | 16.2 |
|
|
| 19 | 0.6.0 | | question | **Run the documented Docker commands on macOS and fix whatever misbehaves.** | 2 | 2 | 1 | 3 | 3 | 1 by 3 | 3.3 |
|
|
| 16 | 0.6.0 | | question | **Decide whether the single Keto `Resource` namespace splits into per-domain namespaces.** | 3 | 2 | 3 | 6 | 6 | 7 by 2 | 0.5 |
|
|
| 14 | 0.6.0 | | | **Drop a double-clicked duplicate submit, with no client-side JavaScript.** | 4 | 2 | 3 | 7 | 7 | 2 by 7, 1 by 4 | 1.4 |
|
|
|
|
## Renamed
|
|
|
|
- 0.4.21 renamed to 0.5.0
|
|
- 0.4.22 renamed to 0.5.0
|
|
|
|
## Details
|
|
|
|
### 62. Delete a group's grants and its membership set in one Keto transaction, so a failure cannot leave it half-deleted.
|
|
|
|
`groupsDelete` in `examples/plugins/auth-admin/admin-groups.ts` drops each held grant with its own
|
|
`deleteTuple`, then the membership tuple, so a Keto failure part-way leaves a group with some grants
|
|
gone and its members still listed. Send all the deletes through `KetoClient.transactTuples`, as
|
|
`applyGrants` in `admin-grants.ts` does. The comment on delete order stays true inside one
|
|
transaction.
|
|
|
|
### 19. Run the documented Docker commands on macOS and fix whatever misbehaves.
|
|
|
|
Needs a Mac. Two suspects, both from `--user "$(id -u):$(id -g)"`: a macOS `id -g` is `20`, which is
|
|
`dialout` inside the noble image, and Docker Desktop remaps bind-mount ownership in its VM.
|
|
|
|
### 16. Decide whether the single Keto `Resource` namespace splits into per-domain namespaces.
|
|
|
|
Ory's own examples model `Shift`, `Document` and so on. One global `Resource` bucket is the
|
|
project's "no catch-all names" rule applied to namespaces.
|
|
|
|
### 14. Drop a double-clicked duplicate submit, with no client-side JavaScript.
|
|
|
|
A second identical POST is expected from a non-technical user, and today creates two
|
|
users, mints two recovery codes, or registers two OAuth2 clients. It must not break a legitimately
|
|
repeatable action. Sketch: a CSS-only affordance so the second click has nothing to hit, plus the
|
|
host recognising a duplicate (same session, route and payload within a short window), logging and
|
|
dropping it. Open: what identifies "the same submission" (a one-time token minted into each form
|
|
beats hashing the payload), the window, where the record lives given the host is stateless, and how
|
|
a plugin declares a route repeatable.
|