feat(#3297): add shared types, service ref, and permissions to boost-common - #3396
feat(#3297): add shared types, service ref, and permissions to boost-common#3396fullsend-ai-coder[bot] wants to merge 2 commits into
Conversation
…common Scaffold boost-common with the foundation types and permissions that all other boost packages depend on: - AgenticProvider, ProviderDescriptor, ProviderCapabilities interfaces - NormalizedStreamEvent union type for provider-agnostic streaming - ConversationSummary, ConversationDetails, InputItem conversation types - boostAiProviderServiceRef via createServiceRef (id: boost.ai-provider) - 16 resource permissions (10 agent + 5 tool + 1 kagenti-infra) - 5 functional permissions (chat, documents, mcp, config) - Resource types: boost-agent, boost-tool - Conditional rule names: IS_OWNER, IS_NOT_CREATOR, HAS_LIFECYCLE_STAGE - boost.access and boost.admin top-level gate permissions No provider-specific types are included in the common package. Closes #3297 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Missing ChangesetsThe following package(s) are changed by this PR but do not have a changeset:
See CONTRIBUTING.md for more information about how to add changesets. Changed Packages
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3396 +/- ##
==========================================
+ Coverage 54.01% 54.03% +0.01%
==========================================
Files 2409 2411 +2
Lines 87705 87739 +34
Branches 24278 24278
==========================================
+ Hits 47373 47407 +34
Misses 38829 38829
Partials 1503 1503
*This pull request uses carry forward flags. Click here to find out more. Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
|
🤖 Finished Review · ✅ Success · Started 8:12 PM UTC · Completed 8:23 PM UTC |
|
/fs-fix you need to run yarn build:api-reports so that CI will pass |
|
/fs-fix CI fails at the |
ReviewFindingsMedium
Low
Info
Previous runReviewFindingsHigh
Low
Info
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| @@ -0,0 +1,33 @@ | |||
| /* | |||
There was a problem hiding this comment.
[high] api-contract
The file imports createServiceRef (a runtime value) from @backstage/backend-plugin-api, but boost-common has backstage.role: common-library. When a frontend plugin depends on boost-common, the bundler will pull in @backstage/backend-plugin-api, which will fail in a browser environment.
Suggested fix: Move boostAiProviderServiceRef into a backend-specific package (e.g., boost-node) with backstage.role: node-library. Alternatively, if no frontend plugin will ever depend on boost-common, change the role to node-library.
There was a problem hiding this comment.
yep this is correct, and forces me to redo the openspec's to a fair degree, as well as re-write the description for #3297
as a result, I will close this PR and have fullsend's code agent generation a new PR with the updated input
| resourceType: RESOURCE_TYPE_BOOST_AGENT, | ||
| }); | ||
|
|
||
| /** |
There was a problem hiding this comment.
[low] logic-error
boostResourcePermissions is documented as All 16 resource permissions but contains 4 basic permissions without resourceType. The array name and JSDoc are misleading.
| /** | ||
| * Permission to approve a pending agent (pending → published). | ||
| * Conditional rules: IS_NOT_CREATOR, HAS_LIFECYCLE_STAGE. | ||
| * |
There was a problem hiding this comment.
[low] rbac-violation
boostAgentConfigurePermission is a basic permission (no resourceType), so conditional rules like IS_OWNER cannot scope it to a specific agent. The JSDoc implies per-agent scoping.
| * (namespace management, build pipelines, sandbox, platform links). | ||
| * | ||
| * @public | ||
| */ |
There was a problem hiding this comment.
[low] permission-expansion
boostKagentiAdminPermission is a basic permission with broad infrastructure scope and no resource scoping.
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * |
There was a problem hiding this comment.
[low] edge-case
BoostAgentPermission type alias covers only resource-typed agent permissions, not the basic ones (list, register, configure).
|
/fs-fix CI fails because |
|
🤖 Finished Fix · ✅ Success · Started 4:22 PM UTC · Completed 4:42 PM UTC |
The API report file was missing, causing CI to fail. Generated it by running `yarn build:api-reports` from the boost workspace root. Addresses review feedback on #3396
🔧 Fix agent — iteration 1 (human-triggered)Generated the missing report.api.md for boost-common by running Fixed (1):
Tests: passed Updated by fullsend fix agent |
|
|
🤖 Finished Review · ✅ Success · Started 4:44 PM UTC · Completed 4:59 PM UTC |
fullsend-ai-review
Bot
added
the
requires-manual-review
|
closing based on #3396 (comment) will revisit #3297 and regenerate a new PR with fullsend's code agent |
…e ref Scaffold the two foundation packages for the boost workspace: boost-common (common-library): - AgenticProvider, ProviderDescriptor, ProviderCapabilities interfaces - NormalizedStreamEvent discriminated union (19 event types) - ConversationSummary, ConversationDetails, InputItem types - ChatRequest, ChatResponse, ResponseUsage types - 16 resource permissions (10 agent + 5 tool + 1 kagenti-infra) - 5 functional permissions (chat.read/create, documents/mcp/config) - Resource types: boost-agent, boost-tool - Conditional rule constants: IS_OWNER, IS_NOT_CREATOR, HAS_LIFECYCLE_STAGE - No dependency on @backstage/backend-plugin-api (browser-safe) boost-node (node-library): - boostAiProviderServiceRef via createServiceRef (id: boost.ai-provider) - Depends on @backstage/backend-plugin-api (backend-only) - Depends on boost-common for the AgenticProvider type parameter The serviceRef lives in boost-node (not boost-common) to avoid pulling @backstage/backend-plugin-api into browser bundles, per PR #3396 review feedback and Backstage convention (plugin-catalog-common + plugin-catalog-node). Closes #3297
Add shared types, service ref, and permission definitions for the boost plugin as the foundation for all other boost packages. boost-common (common-library): - AgenticProvider, ProviderDescriptor, ProviderCapabilities interfaces - NormalizedStreamEvent discriminated union for streaming - ConversationSummary, ConversationDetails, InputItem types - 16 resource permissions (10 agent + 5 tool + 1 kagenti-infra) - 5 functional permissions (chat, documents, mcp, config) - Resource types: boost-agent, boost-tool - Conditional rule names: IS_OWNER, IS_NOT_CREATOR, HAS_LIFECYCLE_STAGE - Top-level gate permissions: boost.access, boost.admin - No dependency on @backstage/backend-plugin-api (browser-safe) boost-node (node-library): - boostAiProviderServiceRef via createServiceRef (id: boost.ai-provider) - Depends on boost-common for AgenticProvider type parameter Addresses PR #3396 review feedback: serviceRef is in boost-node (not boost-common), and resource permissions are correctly typed with their resource types. Closes #3297
Add shared types, service ref, and permission definitions for the boost plugin as the foundation for all other boost packages. boost-common (common-library): - AgenticProvider, ProviderDescriptor, ProviderCapabilities interfaces - NormalizedStreamEvent discriminated union for streaming - ConversationSummary, ConversationDetails, InputItem types - 16 resource permissions (10 agent + 5 tool + 1 kagenti-infra) - 5 functional permissions (chat, documents, mcp, config) - Resource types: boost-agent, boost-tool - Conditional rule names: IS_OWNER, IS_NOT_CREATOR, HAS_LIFECYCLE_STAGE - Top-level gate permissions: boost.access, boost.admin - No dependency on @backstage/backend-plugin-api (browser-safe) boost-node (node-library): - boostAiProviderServiceRef via createServiceRef (id: boost.ai-provider) - Depends on boost-common for AgenticProvider type parameter Addresses PR #3396 review feedback: serviceRef is in boost-node (not boost-common), and resource permissions are correctly typed with their resource types. Closes #3297
Add shared types, service ref, and permission definitions for the boost plugin as the foundation for all other boost packages. boost-common (common-library): - AgenticProvider, ProviderDescriptor, ProviderCapabilities interfaces - NormalizedStreamEvent discriminated union for streaming - ConversationSummary, ConversationDetails, InputItem types - 16 resource permissions (10 agent + 5 tool + 1 kagenti-infra) - 5 functional permissions (chat, documents, mcp, config) - Resource types: boost-agent, boost-tool - Conditional rule names: IS_OWNER, IS_NOT_CREATOR, HAS_LIFECYCLE_STAGE - Top-level gate permissions: boost.access, boost.admin - No dependency on @backstage/backend-plugin-api (browser-safe) boost-node (node-library): - boostAiProviderServiceRef via createServiceRef (id: boost.ai-provider) - Depends on boost-common for AgenticProvider type parameter Addresses PR #3396 review feedback: serviceRef is in boost-node (not boost-common), and resource permissions are correctly typed with their resource types. Closes #3297
Add shared types, service ref, and permission definitions for the boost plugin as the foundation for all other boost packages. boost-common (common-library): - AgenticProvider, ProviderDescriptor, ProviderCapabilities interfaces - NormalizedStreamEvent discriminated union for streaming - ConversationSummary, ConversationDetails, InputItem types - 16 resource permissions (10 agent + 5 tool + 1 kagenti-infra) - 5 functional permissions (chat, documents, mcp, config) - Resource types: boost-agent, boost-tool - Conditional rule names: IS_OWNER, IS_NOT_CREATOR, HAS_LIFECYCLE_STAGE - Top-level gate permissions: boost.access, boost.admin - No dependency on @backstage/backend-plugin-api (browser-safe) boost-node (node-library): - boostAiProviderServiceRef via createServiceRef (id: boost.ai-provider) - Depends on boost-common for AgenticProvider type parameter Addresses PR #3396 review feedback: serviceRef is in boost-node (not boost-common), and resource permissions are correctly typed with their resource types. Closes #3297
* feat(#3297): scaffold boost-common and boost-node packages Add shared types, service ref, and permission definitions for the boost plugin as the foundation for all other boost packages. boost-common (common-library): - AgenticProvider, ProviderDescriptor, ProviderCapabilities interfaces - NormalizedStreamEvent discriminated union for streaming - ConversationSummary, ConversationDetails, InputItem types - 16 resource permissions (10 agent + 5 tool + 1 kagenti-infra) - 5 functional permissions (chat, documents, mcp, config) - Resource types: boost-agent, boost-tool - Conditional rule names: IS_OWNER, IS_NOT_CREATOR, HAS_LIFECYCLE_STAGE - Top-level gate permissions: boost.access, boost.admin - No dependency on @backstage/backend-plugin-api (browser-safe) boost-node (node-library): - boostAiProviderServiceRef via createServiceRef (id: boost.ai-provider) - Depends on boost-common for AgenticProvider type parameter Addresses PR #3396 review feedback: serviceRef is in boost-node (not boost-common), and resource permissions are correctly typed with their resource types. Closes #3297 * fix: address review feedback on PR #3442 - Rename boostResourcePermissions to boostEntityPermissions and update JSDoc from "All 16 resource permissions" to "All 16 entity permissions" - Add conditional rule JSDoc lines to boostToolDemotePermission (IS_OWNER, HAS_LIFECYCLE_STAGE), boostToolPublishPermission (HAS_LIFECYCLE_STAGE), and boostToolUnpublishPermission (IS_OWNER) - Replace InputItem interface with discriminated union type - Update test imports and references for the rename - Regenerate API reports Addresses review feedback on #3442 * fix(boost): add JSDoc remark to boostKagentiAdminPermission Document intentional coarse-grained design as BasicPermission and note that splitting into ResourcePermission should be considered if fine-grained infra access control is needed later. Addresses review feedback on #3442 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: fullsend-code <278716306+fullsend-ai-coder[bot]@users.noreply.github.com> Co-authored-by: gabemontero <gmontero@redhat.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2 participants
Scaffold boost-common with the foundation types and permissions that all other boost packages depend on:
No provider-specific types are included in the common package.
Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com
Closes #3297
Post-script verification
fs/issue-3297-boost-common-types-permissions)ea15b340e24639bee5526b9d5bfd7fa27c51e869..HEAD)