fix(ruleset): check owner on vote_response instead of participant on vote for POST /vote_responses#36
Merged
Merged
Conversation
…vote for POST /vote_responses No participant tuples exist on vote objects in OpenFGA. The correct authorization signal is the owner tuple on the vote_response, which is written ahead of the create call by the invite/seed flow. Issue: LFXV2-1842 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Jordan Evans <jevans@linuxfoundation.org>
There was a problem hiding this comment.
Pull request overview
This PR updates the Heimdall/OpenFGA authorization rule for POST /vote_responses to check ownership on the vote response object instead of checking a removed participant relation on the parent vote.
Changes:
- Switches the vote response create RuleSet check to
owneronvote_response:{vote_response_uid}. - Updates API and architecture docs to reflect the new required permission.
- Removes the obsolete
participantglossary entry.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
charts/lfx-v2-voting-service/templates/ruleset.yaml |
Updates the OpenFGA object/relation used for creating vote responses. |
docs/api-contracts.md |
Documents the new required permission for POST /vote_responses. |
docs/glossary.md |
Removes participant and expands owner to cover create/update. |
docs/itx-proxy-implementation.md |
Updates the permission model summary to remove participant. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
andrest50
approved these changes
May 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
POST /vote_responsesin prod after the recent ruleset updateparticipantonvote:{vote_uid}, but noparticipanttuples exist on vote objects in OpenFGA (onlycommitteeandproject)owneronvote_response:{vote_response_uid}— tuples are written ahead of the create call by the invite/seed flow and are already presentapi-contracts.md,glossary.md,itx-proxy-implementation.md) to remove the now-unusedparticipantrelationFixes: LFXV2-1842
🤖 Generated with Claude Code