Release 2.10.0: the gate fails closed when it cannot confirm an approval - #119
Merged
Conversation
Minor rather than patch because runtime behavior changes for merchants. A response the gate cannot read as an approval is now refused where it was previously allowed: a missing or null decision, an unrecognised decision value, and an allow whose policy_result did not pass on a request that sent a policy. No exported surface changes, so nothing to migrate. A merchant seeing any of those shapes in production has a real problem the gate was hiding, and the availability escape hatch for the unreadable-response case is still failOpen.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Version bump for the fail-closed change merged in #118, plus the
PolicyBlockdocumentation from #117.Minor rather than patch, because runtime behavior changes for merchants. A response the gate cannot read as an approval is now refused where it was previously allowed: a missing or null decision, an unrecognised decision value, and an
allowwhosepolicy_resultdid not pass on a request that sent a policy.Type of change
The version bump itself is maintenance; the behavior it releases landed in #118 and is classified there.
Public API
No exported type, signature or wire-format changes.
Behavior changes for three response shapes that should not occur against a current API, all of which now deny where they previously allowed. Nothing to migrate: a merchant seeing any of them in production has a real problem the gate was hiding, and
failOpenstill applies to the unreadable-response case, which is the only one of the three that is an availability question rather than a compliance one.Test plan
bun run lint,bun run typecheck(including the examples project) andbun run testall clean on the bumped tree: 119 files, 1824 tests passing, 4 skipped.The behavior itself is verified in #118, including drills that reintroduce each guard's removal and confirm the tests fail.
Checklist