fix(cli): require provider-scoped writeback tokens#325
Conversation
|
Warning Review limit reached
More reviews will be available in 26 minutes and 29 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request refactors the scope resolution logic for writeback push operations in cmd/relayfile-cli/main.go by introducing writebackPushScopes and a helper writebackPushProvider, along with corresponding unit tests. The feedback suggests removing a redundant length check on the output of strings.Split and deleting the now-unused functions writebackPushJoinScopes and writebackPushRequiredRelayfileScopes to clean up dead code.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| if len(parts) == 0 { | ||
| return "", false | ||
| } | ||
| provider := strings.TrimSpace(parts[0]) | ||
| return []string{fmt.Sprintf("relayfile:fs:write:/%s/**", provider)} | ||
| if provider == "" { | ||
| return "", false | ||
| } | ||
| return provider, true |
There was a problem hiding this comment.
The check len(parts) == 0 is redundant because strings.Split always returns a slice of at least length 1 (even when splitting an empty string). We can safely remove this check to simplify the function.
provider := strings.TrimSpace(parts[0])
if provider == "" {
return "", false
}
return provider, true| provider, ok := writebackPushProvider(remotePath) | ||
| if !ok { | ||
| return nil | ||
| } |
There was a problem hiding this comment.
The function writebackPushJoinScopes is no longer used anywhere in the codebase, as its only caller in runWritebackFileMutation was updated to use writebackPushScopes. It should be completely removed to clean up dead code.
| provider, ok := writebackPushProvider(remotePath) | ||
| if !ok { | ||
| return nil | ||
| } | ||
| return []string{fmt.Sprintf("relayfile:fs:write:/%s/**", provider)} | ||
| } |
There was a problem hiding this comment.
The function writebackPushRequiredRelayfileScopes is no longer used anywhere in the codebase, as its only caller in runWritebackFileMutation was updated to use writebackPushScopes. It should be completely removed to clean up dead code.
Relayfile Eval ReviewRun: Passed: 4 | Needs human: 0 | Reviewable: 0 | Missing output: 0 | Failed: 0 | Skipped: 0 Human Review CasesNo reviewable human-review cases captured Relayfile output. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0fa92f827e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| return []string{fmt.Sprintf("fs:write:/%s/**", provider), "ops:read"}, | ||
| []string{fmt.Sprintf("relayfile:fs:write:/%s/**", provider)}, |
There was a problem hiding this comment.
When the CLI mints a delegated token for /linear/** here, it immediately uses that bearer against /fs/bulk; however I checked internal/httpapi/server.go and the scopePath switch has no bulk_write case, so authorizeBearer falls back to scopeMatches, where any relayfile:fs:write:<path> grant satisfies plain fs:write, and handleBulkWrite only checks permission policy rather than scopeMatchesPath per file. In a default-open workspace, a token minted by this path for one provider is still accepted for bulk writes to other paths if the credential is reused or exposed, so the provider-scoped writeback boundary this change depends on is not actually enforced.
Useful? React with 👍 / 👎.
Review: PR #325 —
|
|
ℹ️ pr-reviewer: review only — no file changes were applied to the PR (nothing to commit after review). The notes below are advisory and were not pushed. Review: PR #325 —
|
Review: PR #325 —
|
|
One last correctness consideration: the per-file scope check is placed before the The PR is sound. Writing the final review. Review: PR #325 —
|
1 participant
Summary
fs:write:/**/relayfile:fs:write:/**)fs:write:/linear/**,relayfile:fs:write:/linear/**)Context
Completes the caller-side half of the relayauth#55 / relayauth#57 mount-scope fix. Relayauth v0.2.16 now accepts bounded provider-subtree path tokens while still rejecting whole-tree scopes, so callers must not send the global
/**fallback to path-token mint.Verification
go test ./cmd/relayfile-cli -run 'TestWritebackPushScopesRequireProviderSubtree|TestWritebackPushPostsBulkAndWritesAckedReceipt'go test ./cmd/relayfile-cli