fix: use action in [...] and remove resource filter for all-tables/al…

[gugu]

…l-dashboards policies

Replace action like with action in [...] for wildcard table/dashboard actions, and use bare resource instead of resource like .../* when targeting all tables or all dashboards. Both frontend and backend parsers updated to handle the new syntax with backwards compatibility for like.

[Copilot]

Pull request overview

This PR updates the Cedar policy syntax used for “all tables” / “all dashboards” permissions by replacing action like ...:* with action in [...], and by switching wildcard resources from resource like RocketAdmin::<Type>::".../*" to bare resource. Both frontend and backend policy parsers are updated to recognize the new syntax while remaining compatible with existing like-based policies.

Changes:

• Generate wildcard table/dashboard policies using action in [...] instead of action like ...:*.
• Generate wildcard “all tables/dashboards” policies using bare resource instead of resource like .../*.
• Update frontend and backend policy parsers to expand action in [...] into per-action permits.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
frontend/src/app/lib/cedar-policy-parser.ts	Adds action in [...] parsing/expansion and changes how missing resources are interpreted.
frontend/src/app/lib/cedar-policy-items.ts	Generates action in [...] for wildcard actions and uses bare resource for all-tables/all-dashboards resources.
backend/src/entities/cedar-authorization/cedar-policy-parser.ts	Adds action in [...] parsing/expansion and updates classical-permissions derivation to handle wildcard/all-resources cases.

Comments suppressed due to low confidence (2)

backend/src/entities/cedar-authorization/cedar-policy-parser.ts:194

• Same issue as frontend: action in [...] leaves result.action null, so resourceClause && !result.action marks permit(principal, action in [...], resource); as isWildcard (full access) after expansion. This will mis-sync classical permissions and can unintentionally elevate connection/group access when saving policies that target all tables/dashboards. Update wildcard detection to account for actions being present (or only set isWildcard when both action and resource are unconstrained variables).

}

function extractDashboardId(resourceId: string | null, connectionId: string): string | null {
	if (!resourceId) return null;
	const prefix = `${connectionId}/`;
	if (resourceId.startsWith(prefix)) {
		return resourceId.slice(prefix.length);
	}
	return resourceId;
}

backend/src/entities/cedar-authorization/cedar-policy-parser.ts:77

• This change treats a missing/unparsed permit.resourceId as '*' (all tables). If parsePermitBody fails to parse a valid but unsupported resource constraint (e.g. resource is RocketAdmin::Table), the classical permissions sync will over-grant by assuming a wildcard. Prefer distinguishing “bare resource” (intentional all-tables) from “resource expression not parsed”; e.g., set an explicit flag in parsePermitBody when resource is bare, and otherwise skip when resourceId is null.

				if (!dashboardId) break;
				const dashboardEntry = getOrCreateDashboardEntry(dashboardMap, dashboardId);
				applyDashboardAction(dashboardEntry, permit.action);
				break;
			}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.