fix(policy): reject no-op rules, drop the policy HTTP surface by taitelee · Pull Request #541 · Wave-RF/WaveHouse

taitelee · 2026-09-01T15:13:05Z

Summary

The policy's entire HTTP surface is removed: GET /v1/ops/policy, POST /v1/ops/policy/validate, and the SDK's wh.policy namespace. Both endpoints were born alongside PUT /v1/ops/policy and outlived it when #508 deleted the policy write API — with files as the only write path, the policy is read, edited, and validated where it lives. The dry run had also kept its original lenient decoder while adoption became strict, so it certified {"valid": true} for documents a reload would refuse — including #460's "eq"-for-"_eq" typo, which silently decodes to a filter that disables row security; deleting it removes the last non-strict policy decode site (#514's other five were deleted or made strict by #508). Its replacement is wavehouse validate, which enforces strictly more (the cross-file role references a single-document dry run could never see). The break-glass story narrows to match: the operator key still triggers POST /v1/ops/settings/reload, whose findings report exactly why a rejected directory was refused; a bad edit still never breaks a running server. The e2e read-modify-write pattern moves from wh.policy.get() to reading the harness-owned policies.json (readPolicyFile() — the file is the adopted policy there, since setPolicy fails unless the reload reports adoption). The SDK keeps the policy document types (Policy, TablePolicy, RolePermissions) — they describe policies.json; GET /v1/ops/pipes[/{name}] is untouched.

validateRolePerms gains three rejections for well-formed rules the engine would silently not honor, the fail-open shapes strict decoding can't see (#460): a filter entry with no operator ("tenant_id": {} — zero predicates, row security off), an operator-less check entry, and filter: under an insert: grant. Every adoption — boot, watch, SIGHUP, reload, wavehouse validate — funnels through the one policy.Validate path, so the checks land everywhere at once. No shipped seed, compose, or fixture policy carries any rejected shape. Docs are synced across the API, access-control, settings-directory, configuration, development, architecture, reverse-proxy, and SDK pages, plus AGENTS.md and CHANGELOG.md.

Related Issues

Closes #514
Closes #460

github-actions · 2026-09-01T15:15:53Z

📚 Docs preview is live → https://20b178ba-wavehouse-docs.wave-rf.workers.dev

Commit — 8eb7f16: fix(policy): reject check under select; address review findings
Author — @taitelee
Committed — 2026-09-01 15:10 (UTC-04:00)
Deployed — 2026-09-01 15:19 EDT

github-code-quality · 2026-09-01T15:16:37Z

Code Coverage Overview

Languages: Go

Go

The overall line coverage in commit 8eb7f16 in the policy-strict-decode branch remains at 90%, unchanged from commit 29b42da in the main branch.

_{Updated September 01, 2026 19:20 UTC}

coderabbitai · 2026-09-01T15:19:20Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: d1a6eb73-e66e-4e6a-9404-da575fffbf54

📥 Commits

Reviewing files that changed from the base of the PR and between f98d054 and 8eb7f16.

📒 Files selected for processing (8)

CHANGELOG.md
cmd/wavehouse/main.go
docs/src/content/docs/access-control.mdx
docs/src/content/docs/configuration.mdx
internal/policy/policy.go
internal/policy/policy_test.go
internal/settings/validate_test.go
tests/e2e/sdk/admin.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

🧠 Learnings (3)

📓 Common learnings

Learnt from: CR
Repo: Wave-RF/WaveHouse

Timestamp: 2026-09-01T19:48:41.601Z
Learning: Run `make lint` and `make test` before considering work complete.

Learnt from: CR
Repo: Wave-RF/WaveHouse

Timestamp: 2026-09-01T19:48:41.601Z
Learning: Every new function should have corresponding test cases.

Learnt from: CR
Repo: Wave-RF/WaveHouse

Timestamp: 2026-09-01T19:48:41.601Z
Learning: Validate locally before every push

📚 Learning: 2026-06-26T12:23:22.696Z

Learnt from: EricAndrechek
Repo: Wave-RF/WaveHouse PR: 346
File: internal/stream/subscriber_test.go:9-28
Timestamp: 2026-06-26T12:23:22.696Z
Learning: In this Go repository, prefer table-driven tests (e.g., `[]struct{...}` with `t.Run(...)`) only for tests that cover multiple scenarios/inputs and can be cleanly enumerated. Do not artificially rewrite a clear single-scenario sequential behavioral-flow test into a table-driven form just to fit the pattern; if there’s only one meaningful scenario, keep the test as a straightforward linear flow (as in `TestSubscriber_SendDeliversThenDropsWhenFull`).

Applied to files:

internal/settings/validate_test.go
internal/policy/policy_test.go

📚 Learning: 2026-08-13T12:17:52.620Z

Learnt from: EricAndrechek
Repo: Wave-RF/WaveHouse PR: 470
File: docs/src/content/docs/reverse-proxy.mdx:137-144
Timestamp: 2026-08-13T12:17:52.620Z
Learning: For Wave-RF/WaveHouse documentation, verify claims about implementation control flow against the authoritative implementation source (for example, internal/auth/auth.go) rather than relying solely on docs/** content. Documentation may lag behind or paraphrase behavior, so control-flow claims should be confirmed in source code.

Applied to files:

docs/src/content/docs/configuration.mdx
docs/src/content/docs/access-control.mdx

🪛 LanguageTool

CHANGELOG.md

[typographical] ~39-~39: Consider using an em dash in dialogues and enumerations.
Context: - **Policy validation now rejects the fai...

(DASH_RULE)

[style] ~39-~39: The word ‘caveat’ is a legal term. To make your text as clear as possible to all readers, do not use this foreign term unless it is used with its legal meaning. Possible alternatives are “caution” or “warning”.
Context: ...use validateat once.#460`'s migration caveat (a stored policy hard-failing at boot) ...

(CAVEAT)

🔇 Additional comments (8)

docs/src/content/docs/configuration.mdx (1)

122-122: LGTM!

tests/e2e/sdk/admin.test.ts (1)

4-4: LGTM!

Also applies to: 20-20, 92-92, 102-104

internal/policy/policy.go (1)

664-665: LGTM!

internal/policy/policy_test.go (1)

665-681: LGTM!

internal/settings/validate_test.go (1)

252-252: LGTM!

CHANGELOG.md (1)

39-39: LGTM!

docs/src/content/docs/access-control.mdx (1)

126-126: LGTM!

Also applies to: 204-204, 329-335

cmd/wavehouse/main.go (1)

191-191: LGTM!

📝 Walkthrough

Summary by CodeRabbit

New Features
- Added stricter policy validation for operator-less filter and check entries.
- Rejected filter clauses under insert grants and check clauses under select grants.
Changes
- Policy validation now uses wavehouse validate and the settings reload workflow.
- Removed policy HTTP endpoints and their TypeScript SDK APIs.
Documentation
- Updated access-control, API, SDK, and configuration guidance to reflect the new policy workflow and validation rules.

Walkthrough

The PR removes policy inspection and dry-run validation HTTP endpoints and the TypeScript policy namespace. Policy validation now rejects operator-less filter and check entries. Documentation and end-to-end tests use policies.json, wavehouse validate, and settings reload instead.

Changes

Policy surface and validation updates

Layer / File(s)	Summary
Reject ineffective policy rules `internal/policy/policy.go`, `internal/policy/policy_test.go`, `internal/settings/validate_test.go`, `docs/src/content/docs/access-control.mdx`	Policy validation rejects operator-less `filter` and `check` entries and rejects `filter` under `insert` grants and `check` under `select` grants.
Remove policy HTTP and SDK surfaces `internal/api/policy.go`, `internal/api/router.go`, `internal/api/router_test.go`, `cmd/wavehouse/main.go`, `clients/ts/src/`, `docs/src/content/docs/sdk/`	The policy handler, router wiring, SDK namespace, validation result type, and endpoint tests were removed. The CLI no longer wires the policy dependency.
Migrate policy test workflows `tests/e2e/sdk/*`	SDK end-to-end tests read and restore policies from the local settings file instead of the removed policy API.
Update policy documentation and guidance `docs/src/content/docs/`, `AGENTS.md`, `CHANGELOG.md`, `internal/policy/scalars.go`, `internal/auth/`	Documentation and guidance describe file-based validation, settings reload, stricter policy rules, and the removed policy endpoints.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: 🔵 Low · up to 8eb7f

This change removes the policy HTTP endpoints and SDK namespace, so existing consumers that still use them will fail after upgrading and must migrate to file-based policy management and CLI validation. The change is otherwise mergeable, with explicit owner awareness required for that compatibility impact.

Suggested reviewers: ericandrechek

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 70.59% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 17 functions across 18 files. (3 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies both primary changes: rejecting no-op policy rules and removing the policy HTTP surface.
Description check	✅ Passed	The description directly explains the policy HTTP removal, validation changes, replacement workflow, affected tests, and documentation updates.
Linked Issues check	✅ Passed	The changes satisfy the linked objectives in [`#514`] and [`#460`]. They remove the remaining lenient validation endpoint, rely on strict settings-directory validation, reject operator-less and operation-…
Out of Scope Changes check	✅ Passed	The code, SDK, test, documentation, AGENTS.md, and CHANGELOG.md changes support the linked policy hardening and HTTP-surface removal objectives. No unrelated code changes are identified.

Full details: Linked Issues check

Explanation

The changes satisfy the linked objectives in [#514] and [#460]. They remove the remaining lenient validation endpoint, rely on strict settings-directory validation, reject operator-less and operation-inapplicable rules, and update all documented validation and adoption paths.

Full details: Docstring Coverage

Explanation

Docstring coverage is 70.59% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 17 functions across 18 files. (3 skipped: 3 unsupported.)

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch policy-strict-decode

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch policy-strict-decode

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 5a0efc59-4d97-4dc2-be1a-f7dc90884ee6

📥 Commits

Reviewing files that changed from the base of the PR and between 2812cb8 and e12d75c.

📒 Files selected for processing (10)

CHANGELOG.md
clients/ts/src/policy.ts
docs/src/content/docs/access-control.mdx
docs/src/content/docs/api.md
internal/api/policy.go
internal/api/policy_test.go
internal/policy/policy.go
internal/policy/policy_test.go
internal/settings/validate.go
internal/settings/validate_test.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Review details

⏰ Context from checks skipped due to timeout. (5)

GitHub Check: Coverage
GitHub Check: E2E tests
GitHub Check: Integration tests
GitHub Check: Docs build
GitHub Check: Lint

🧰 Additional context used

📓 Path-based instructions (6)

**Opt a page into the Cloud CTA with `cloudCta` frontmatter**, not by importing the component.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

docs/src/content/docs/access-control.mdx

Every code change updates its docs + `CHANGELOG.md` in the same PR

📄 CodeRabbit inference engine (AGENTS.md)

Files:

clients/ts/src/policy.ts
internal/settings/validate.go
internal/policy/policy.go
CHANGELOG.md
internal/api/policy_test.go
internal/settings/validate_test.go
docs/src/content/docs/access-control.mdx
docs/src/content/docs/api.md
internal/policy/policy_test.go
internal/api/policy.go

Every new function should have corresponding test cases.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

internal/api/policy_test.go
internal/settings/validate_test.go
internal/policy/policy_test.go

Exactly one runtime dependency — `eventsource-parser` (SSE framing, itself dependency-free); adding a second needs the same scrutiny the first got.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

clients/ts/src/policy.ts

**In MDX, leave a blank line between a JSX tag and a code fence.**

📄 CodeRabbit inference engine (AGENTS.md)

Files:

docs/src/content/docs/access-control.mdx

**Never hard-wrap prose. One paragraph is one line.** No wrapping at 72/80 columns, no "semantic linefeeds" splitting a paragraph at sentence boundaries.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

CHANGELOG.md
docs/src/content/docs/api.md

🧠 Learnings (3)

📚 Learning: 2026-06-26T12:23:22.696Z

Learnt from: EricAndrechek
Repo: Wave-RF/WaveHouse PR: 346
File: internal/stream/subscriber_test.go:9-28
Timestamp: 2026-06-26T12:23:22.696Z
Learning: In this Go repository, prefer table-driven tests (e.g., `[]struct{...}` with `t.Run(...)`) only for tests that cover multiple scenarios/inputs and can be cleanly enumerated. Do not artificially rewrite a clear single-scenario sequential behavioral-flow test into a table-driven form just to fit the pattern; if there’s only one meaningful scenario, keep the test as a straightforward linear flow (as in `TestSubscriber_SendDeliversThenDropsWhenFull`).

Applied to files:

internal/api/policy_test.go
internal/settings/validate_test.go
internal/policy/policy_test.go

📚 Learning: 2026-05-23T01:23:59.268Z

Learnt from: EricAndrechek
Repo: Wave-RF/WaveHouse PR: 174
File: internal/api/ingest_test.go:111-111
Timestamp: 2026-05-23T01:23:59.268Z
Learning: In WaveHouse Go tests in internal/api/**/*_test.go, use internal/testutil.AssertJSONErrorResponse(t, w) for HTTP error-path JSON assertions. Do not use (or reintroduce) package-local assertJSONErrorResponse helpers. AssertJSONErrorResponse verifies the response Content-Type is application/json, includes the X-Content-Type-Options: nosniff header, and that the JSON body contains an "error" field.

Applied to files:

internal/api/policy_test.go

📚 Learning: 2026-08-13T12:17:52.620Z

Learnt from: EricAndrechek
Repo: Wave-RF/WaveHouse PR: 470
File: docs/src/content/docs/reverse-proxy.mdx:137-144
Timestamp: 2026-08-13T12:17:52.620Z
Learning: For Wave-RF/WaveHouse documentation, verify claims about implementation control flow against the authoritative implementation source (for example, internal/auth/auth.go) rather than relying solely on docs/** content. Documentation may lag behind or paraphrase behavior, so control-flow claims should be confirmed in source code.

Applied to files:

docs/src/content/docs/access-control.mdx

🪛 LanguageTool

CHANGELOG.md

[style] ~37-~37: The word ‘caveat’ is a legal term. To make your text as clear as possible to all readers, do not use this foreign term unless it is used with its legal meaning. Possible alternatives are “caution” or “warning”.
Context: ...icy/validateat once.#460`'s migration caveat (a stored policy hard-failing at boot) ...

(CAVEAT)

🔇 Additional comments (10)

internal/policy/policy.go (1)

63-69: LGTM!

Also applies to: 661-663, 673-675, 685-687

internal/policy/policy_test.go (1)

613-664: LGTM!

internal/api/policy.go (1)

5-10: LGTM!

Also applies to: 43-78

internal/api/policy_test.go (1)

87-89: LGTM!

Also applies to: 91-133, 135-147

docs/src/content/docs/api.md (1)

763-763: LGTM!

internal/settings/validate.go (1)

56-62: LGTM!

Also applies to: 64-72

internal/settings/validate_test.go (1)

454-456: LGTM!

Also applies to: 458-482

CHANGELOG.md (1)

33-35: LGTM!

Also applies to: 37-38

clients/ts/src/policy.ts (1)

32-38: LGTM!

docs/src/content/docs/access-control.mdx (1)

185-186: LGTM!

Also applies to: 204-204

Rerequesting.

taitelee · 2026-09-01T16:02:40Z

@coderabbitai review

coderabbitai · 2026-09-01T16:12:00Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 47a30fcc-aa98-42ae-99d8-11e7b47bb931

📥 Commits

Reviewing files that changed from the base of the PR and between e12d75c and c9eedcc.

📒 Files selected for processing (29)

AGENTS.md
CHANGELOG.md
clients/ts/src/client.test.ts
clients/ts/src/client.ts
clients/ts/src/index.ts
clients/ts/src/namespaces.test.ts
clients/ts/src/policy.ts
clients/ts/src/types.ts
cmd/wavehouse/main.go
docs/src/content/docs/access-control.mdx
docs/src/content/docs/api.md
docs/src/content/docs/architecture.md
docs/src/content/docs/configuration.mdx
docs/src/content/docs/development.md
docs/src/content/docs/reverse-proxy.mdx
docs/src/content/docs/sdk/admin.md
docs/src/content/docs/sdk/reference.md
docs/src/content/docs/settings-directory.mdx
internal/api/policy.go
internal/api/policy_test.go
internal/api/router.go
internal/api/router_test.go
internal/policy/scalars.go
internal/settings/validate_test.go
tests/e2e/sdk/admin.test.ts
tests/e2e/sdk/ingest.test.ts
tests/e2e/sdk/query.test.ts
tests/e2e/sdk/settings.ts
tests/e2e/sdk/streaming.test.ts

💤 Files with no reviewable changes (11)

cmd/wavehouse/main.go
clients/ts/src/client.ts
clients/ts/src/namespaces.test.ts
docs/src/content/docs/sdk/reference.md
internal/api/policy.go
clients/ts/src/types.ts
internal/api/router.go
clients/ts/src/policy.ts
clients/ts/src/index.ts
clients/ts/src/client.test.ts
internal/api/policy_test.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Review details

⏰ Context from checks skipped due to timeout. (2)

GitHub Check: Docs build
GitHub Check: Coverage

🧰 Additional context used

📓 Path-based instructions (2)

Never hard-wrap prose. One paragraph is one line.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

docs/src/content/docs/configuration.mdx
CHANGELOG.md
AGENTS.md
docs/src/content/docs/settings-directory.mdx
docs/src/content/docs/access-control.mdx
docs/src/content/docs/development.md
docs/src/content/docs/api.md
docs/src/content/docs/architecture.md
docs/src/content/docs/sdk/admin.md
docs/src/content/docs/reverse-proxy.mdx

In MDX, leave a blank line between a JSX tag and a code fence.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

docs/src/content/docs/configuration.mdx
docs/src/content/docs/settings-directory.mdx
docs/src/content/docs/access-control.mdx
docs/src/content/docs/reverse-proxy.mdx

🧠 Learnings (3)

📓 Common learnings

Learnt from: CR
Repo: Wave-RF/WaveHouse

Timestamp: 2026-09-01T16:34:19.270Z
Learning: Run `make lint` and `make test` before considering work complete.

Learnt from: CR
Repo: Wave-RF/WaveHouse

Timestamp: 2026-09-01T16:34:19.270Z
Learning: Use table-driven tests with `t.Run(tt.name, ...)` for multiple scenarios.

Learnt from: CR
Repo: Wave-RF/WaveHouse

Timestamp: 2026-09-01T16:34:19.270Z
Learning: Validate locally before every push

📚 Learning: 2026-08-13T12:17:52.620Z

Learnt from: EricAndrechek
Repo: Wave-RF/WaveHouse PR: 470
File: docs/src/content/docs/reverse-proxy.mdx:137-144
Timestamp: 2026-08-13T12:17:52.620Z
Learning: For Wave-RF/WaveHouse documentation, verify claims about implementation control flow against the authoritative implementation source (for example, internal/auth/auth.go) rather than relying solely on docs/** content. Documentation may lag behind or paraphrase behavior, so control-flow claims should be confirmed in source code.

Applied to files:

docs/src/content/docs/access-control.mdx

📚 Learning: 2026-06-26T12:23:22.696Z

Learnt from: EricAndrechek
Repo: Wave-RF/WaveHouse PR: 346
File: internal/stream/subscriber_test.go:9-28
Timestamp: 2026-06-26T12:23:22.696Z
Learning: In this Go repository, prefer table-driven tests (e.g., `[]struct{...}` with `t.Run(...)`) only for tests that cover multiple scenarios/inputs and can be cleanly enumerated. Do not artificially rewrite a clear single-scenario sequential behavioral-flow test into a table-driven form just to fit the pattern; if there’s only one meaningful scenario, keep the test as a straightforward linear flow (as in `TestSubscriber_SendDeliversThenDropsWhenFull`).

Applied to files:

internal/settings/validate_test.go

🪛 Betterleaks (1.8.1)

docs/src/content/docs/development.md

[high] 208-210: Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.

(curl-auth-header)

🪛 LanguageTool

CHANGELOG.md

[style] ~37-~37: The word ‘caveat’ is a legal term. To make your text as clear as possible to all readers, do not use this foreign term unless it is used with its legal meaning. Possible alternatives are “caution” or “warning”.
Context: ...use validateat once.#460`'s migration caveat (a stored policy hard-failing at boot) ...

(CAVEAT)

🔇 Additional comments (17)

internal/settings/validate_test.go (1)

249-251: LGTM!

internal/api/router_test.go (1)

371-378: LGTM!

tests/e2e/sdk/admin.test.ts (1)

4-4: LGTM!

Also applies to: 20-20, 92-92, 102-105

tests/e2e/sdk/ingest.test.ts (1)

12-12: LGTM!

Also applies to: 177-177, 180-180, 233-233, 236-236, 292-292, 296-298, 347-347, 360-360, 364-364, 366-366, 380-380

tests/e2e/sdk/query.test.ts (1)

11-11: LGTM!

Also applies to: 188-191, 219-222, 255-262, 276-276, 296-297, 307-307, 420-427, 465-465

tests/e2e/sdk/settings.ts (1)

10-10: LGTM!

Also applies to: 89-89

tests/e2e/sdk/streaming.test.ts (1)

3-4: LGTM!

Also applies to: 11-14

docs/src/content/docs/architecture.md (1)

76-76: LGTM!

docs/src/content/docs/development.md (1)

203-210: LGTM!

docs/src/content/docs/reverse-proxy.mdx (1)

93-93: LGTM!

Also applies to: 203-203

docs/src/content/docs/sdk/admin.md (1)

3-3: LGTM!

AGENTS.md (1)

31-31: LGTM!

Also applies to: 62-62, 371-377, 424-424

CHANGELOG.md (1)

25-26: LGTM!

Also applies to: 37-37

docs/src/content/docs/access-control.mdx (1)

65-77: LGTM!

Also applies to: 90-90, 185-185, 198-198, 204-204, 327-340

docs/src/content/docs/api.md (1)

8-8: LGTM!

Also applies to: 32-32, 42-42, 617-619, 726-728

docs/src/content/docs/settings-directory.mdx (1)

52-52: LGTM!

internal/policy/scalars.go (1)

17-19: LGTM!

Claude-Session: https://claude.ai/code/session_015QrtF3nVYSAV7Lj7gma9Jo

coderabbitai

Actionable comments posted: 2

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 5c184d7c-811e-474d-89f2-3788efa003cc

📥 Commits

Reviewing files that changed from the base of the PR and between c9eedcc and f98d054.

📒 Files selected for processing (11)

CHANGELOG.md
clients/ts/src/client.ts
cmd/wavehouse/main.go
docs/src/content/docs/access-control.mdx
docs/src/content/docs/architecture.md
docs/src/content/docs/configuration.mdx
docs/src/content/docs/sdk/index.mdx
internal/api/router.go
internal/api/router_test.go
internal/auth/auth.go
internal/auth/context.go

💤 Files with no reviewable changes (1)

clients/ts/src/client.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Review details

🧰 Additional context used

🧠 Learnings (3)

📓 Common learnings

Learnt from: CR
Repo: Wave-RF/WaveHouse

Timestamp: 2026-09-01T18:35:09.517Z
Learning: DRY — one source of truth.

Learnt from: CR
Repo: Wave-RF/WaveHouse

Timestamp: 2026-09-01T18:35:09.517Z
Learning: NO_COLOR=1 make ci > tmp/ci.log 2>&1

📚 Learning: 2026-08-13T12:17:52.620Z

Learnt from: EricAndrechek
Repo: Wave-RF/WaveHouse PR: 470
File: docs/src/content/docs/reverse-proxy.mdx:137-144
Timestamp: 2026-08-13T12:17:52.620Z
Learning: For Wave-RF/WaveHouse documentation, verify claims about implementation control flow against the authoritative implementation source (for example, internal/auth/auth.go) rather than relying solely on docs/** content. Documentation may lag behind or paraphrase behavior, so control-flow claims should be confirmed in source code.

Applied to files:

docs/src/content/docs/configuration.mdx

📚 Learning: 2026-06-10T15:01:09.027Z

Learnt from: EricAndrechek
Repo: Wave-RF/WaveHouse PR: 312
File: docs/src/content/docs/development.md:0-0
Timestamp: 2026-06-10T15:01:09.027Z
Learning: In this repo’s Markdown review (all .md files), do not flag capitalization/style issues for literal paths starting with ".github/" (or any substring that is a path beginning with ".github/"). Treat ".github" as the correct lowercase dotfile directory name, even when it appears inside prose or code spans; automated checks such as LanguageTool’s "(GITHUB)" rule commonly produce false positives for this literal filesystem path.

Applied to files:

CHANGELOG.md

🪛 LanguageTool

CHANGELOG.md

[typographical] ~39-~39: Consider using an em dash in dialogues and enumerations.
Context: - **Policy validation now rejects the fai...

(DASH_RULE)

[style] ~39-~39: The word ‘caveat’ is a legal term. To make your text as clear as possible to all readers, do not use this foreign term unless it is used with its legal meaning. Possible alternatives are “caution” or “warning”.
Context: ...use validateat once.#460`'s migration caveat (a stored policy hard-failing at boot) ...

(CAVEAT)

🔇 Additional comments (10)

CHANGELOG.md (1)

39-39: LGTM!

docs/src/content/docs/access-control.mdx (1)

12-12: LGTM!

Also applies to: 329-329, 350-350, 398-398

internal/api/router.go (1)

245-245: LGTM!

Also applies to: 261-261

internal/api/router_test.go (1)

112-112: LGTM!

docs/src/content/docs/sdk/index.mdx (1)

550-550: LGTM!

cmd/wavehouse/main.go (1)

570-570: LGTM!

internal/auth/auth.go (1)

235-236: LGTM!

internal/auth/context.go (1)

74-74: LGTM!

docs/src/content/docs/architecture.md (2)

76-77: LGTM!

234-234: LGTM!

Rereviewing

taitelee · 2026-09-01T19:47:43Z

@coderabbitai review

coderabbitai · 2026-09-01T19:47:51Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

…ave-RF#551) ## Summary `tables.<table>.select.<role>` becomes `tables.<table>.<role>.select`. Field names and semantics are unchanged; only the nesting moves. `select` and `insert` are now distinct types (`SelectPermissions`/`InsertPermissions`), so a field on the wrong side is a validation error instead of being accepted and ignored. There is no automatic conversion — convert the file by hand and run `wavehouse validate` before restarting. A pre-v2 document is reported as one clear finding pointing at the migration note rather than a confusing strict-decode error. Three fail-closed fixes the new shape made visible or possible: - `ResolvedPermissions` now marks the side `Evaluate` did not resolve. An unresolved side is zero, and a zero side reads as an empty allow list plus an empty deny list — which every accessor would answer as "unrestricted". Each one now denies instead, `HasRowFilter` included: it is the reachable gate in front of `RowVisible`, so without it the guard behind it was dead code and both call sites took the whole-bucket fast path. - `evaluateInsert` resolved a check using an operator it does not honor (`_neq`/`_gt`/`_lt`, or the ambiguous `_eq`+`_in`) to no clause at all, authorizing the insert with the rule silently gone — where `evaluateSelect` denies outright in the mirror situation. - A `filter` or `check` entry naming no operator (`"tenant_id": {}`) matched no case in either resolver. **`main` already rejects this at validation** — Wave-RF#541 added that guard — so file adoption was never affected; what this PR adds is the matching deny in `evaluateSelect`/`evaluateInsert`, because `Evaluate` does not re-validate what it is handed and `policy.Static` is a Validate-free `policy.Source`. Reproduced through that path before fixing: `Allowed=true`, `HasRowFilter()=false`, and `RowVisible` true for another tenant's row. Note on scope: an earlier revision of this work also made `POST /v1/ops/policy/validate` agree with file adoption. Wave-RF#541 deleted the policy HTTP surface entirely, so that fix is gone with it — the legacy-layout detector it relied on is still reached through file adoption's own pipeline. ## Stacked PR This is **part 2 of 7** (part 0 merged) in a stack that replaces Wave-RF#540. Each PR is based on the one above it, so review this PR's own diff against its base — GitHub shows only this layer's changes. | # | Branch | Base | | | - | ------ | ---- | - | | 0 | `stack/0-classify-paths` | `main` | ✅ merged as Wave-RF#549 | | 1 | `stack/1-discovery` | `main` | Wave-RF#550, in review | | 2 | `stack/2-policy` | `stack/1-discovery` | **→ this PR** | | 3 | `stack/3-content-type` | `stack/2-policy` | | | 4 | `stack/4-seams` | `stack/3-content-type` | | | 5 | `stack/5-positional-wire` | `stack/4-seams` | | | 6 | `stack/6-computed-columns` | `stack/5-positional-wire` | | Merge in order, top to bottom. Rebasing or squashing out of order will make the later PRs' diffs unreadable. ## Test plan - [x] `make ci` green on this branch's exact tree (verify, unit, integration against live ClickHouse, e2e, all coverage gates) - [x] The branch descends from its base and carries only this layer's change (plus any follow-up commits answering review) - [x] `go.mod` / `go.sum` untouched; no new dependencies ## Review Both pre-push reviewers gate the tip of the stack (Wave-RF#555), whose delta against `main` is the union of all seven branches. This branch was additionally reviewed on its own. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_018Epn88jTEw4ZkXrvTKzZXQ --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Upstream-Commit: 27c22cb

fix(policy): strict-decode the validate dry run, reject no-op rules

e12d75c

github-project-automation Bot added this to WaveHouse Task Board Sep 1, 2026

github-project-automation Bot moved this to Backlog in WaveHouse Task Board Sep 1, 2026

taitelee moved this from Backlog to In review in WaveHouse Task Board Sep 1, 2026

taitelee assigned EricAndrechek Sep 1, 2026

taitelee marked this pull request as ready for review September 1, 2026 15:18

taitelee requested review from a team and EricAndrechek September 1, 2026 15:18

coderabbitai Bot previously requested changes Sep 1, 2026

View reviewed changes

Comment thread docs/src/content/docs/access-control.mdx Outdated

fix(policy): reject no-op rules, drop the validate dry-run endpoint

134a707

taitelee changed the title ~~fix(policy): strict-decode the validate dry run, reject no-op rules~~ fix(policy): reject no-op rules, drop the validate dry-run endpoint Sep 1, 2026

This was referenced Sep 1, 2026

security(policy): strict-decode policy config so unknown keys are rejected, not dropped #514

Closed

security(policy): mistyped or unhonored policy rules load silently and disable row security #460

Closed

taitelee changed the title ~~fix(policy): reject no-op rules, drop the validate dry-run endpoint~~ fix(policy): reject no-op rules, drop the policy HTTP surface Sep 1, 2026

fix(policy): drop the policy HTTP surface

c9eedcc

github-actions Bot added the area/infra CI, build, deploy, Docker, release label Sep 1, 2026

coderabbitai Bot requested changes Sep 1, 2026

View reviewed changes

Comment thread docs/src/content/docs/configuration.mdx Outdated

Merge remote-tracking branch 'origin/main' into policy-strict-decode

baf8ff8

docs: sweep stale policy-inspection claims, narrow validation wording

f98d054

Claude-Session: https://claude.ai/code/session_015QrtF3nVYSAV7Lj7gma9Jo

EricAndrechek requested changes Sep 1, 2026

View reviewed changes

Comment thread internal/policy/policy.go

Comment thread tests/e2e/sdk/admin.test.ts Outdated

Comment thread docs/src/content/docs/access-control.mdx Outdated

Comment thread docs/src/content/docs/access-control.mdx Outdated

coderabbitai Bot previously requested changes Sep 1, 2026

View reviewed changes

Comment thread cmd/wavehouse/main.go Outdated

Comment thread docs/src/content/docs/configuration.mdx Outdated

fix(policy): reject check under select; address review findings

8eb7f16

EricAndrechek approved these changes Sep 1, 2026

View reviewed changes

coderabbitai Bot approved these changes Sep 1, 2026

View reviewed changes

github-project-automation Bot moved this from In review to In progress in WaveHouse Task Board Sep 1, 2026

taitelee added this pull request to the merge queue Sep 1, 2026

Merged via the queue into main with commit 4bee187 Sep 1, 2026
19 checks passed

taitelee deleted the policy-strict-decode branch September 1, 2026 20:00

github-project-automation Bot moved this from In progress to Done in WaveHouse Task Board Sep 1, 2026

This was referenced Sep 2, 2026

feat(policy)!: role-first policies.json with split permission types #551

Merged

feat!: policy v2, positional wire shape, and declared ingest format #540

Closed

sdk(release): npm latest still ships wh.policy and the pipe writers the server deleted #556

Open

taitelee mentioned this pull request Sep 10, 2026

security(policy): policies loaded from KV skip validation, so validation fixes never reach existing deployments #461

Closed

Conversation

taitelee commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issues

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-code-quality Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

Go

Uh oh!

coderabbitai Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

taitelee commented Sep 1, 2026

Uh oh!

coderabbitai Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

taitelee commented Sep 1, 2026

Uh oh!

coderabbitai Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

taitelee commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-code-quality Bot commented Sep 1, 2026 •

edited

Loading

coderabbitai Bot commented Sep 1, 2026 •

edited

Loading

coderabbitai Bot commented Sep 1, 2026 •

edited

Loading

coderabbitai Bot commented Sep 1, 2026 •

edited

Loading