fix(pat): surface issuance degradations at Warn and correct the docs note - #150
Merged
highb merged 1 commit intoAug 25, 2026
Conversation
…note Both privilege degradations added in #149 logged at Debug, so at the default level an operator saw nothing distinguishing a locally computed expiry from one Snowflake actually returned. Per the repo's log-level rules a skip-and-continue degradation is Warn, and both fire once per issuance rather than per resource, so there is no volume concern. The read-back message now also carries the estimated expiry it substituted. The token builder's own skip in ListProgrammaticAccessTokens stays at Debug: that one fires once per user per sync and is the per-resource case the same rules keep quiet. The service-user note in the docs still claimed the connector verifies the default-role grant before issuing. That has been best-effort since #149, so it is softened to match. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
highb
merged commit Aug 25, 2026
081a0c3
into
santhosh.kumar/credential-issuance
9 of 10 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fourth in the stack, after #149. Both suggestions from the judge review on
2220f4d8; both are consequences of #149's own changes.Degradations logged below the default level
#149 added two privilege degradations to
Issue— the skipped default-role check, and the locally computed expiry substituted when the read-back is denied. Both logged atDebug, so at the default level an operator saw nothing distinguishing an estimated expiry from one Snowflake actually returned..claude/skills/ci-review.mdL4 puts skip-and-continue degradation atWarn, and both fire once per issuance rather than once per resource, so L7's volume concern does not apply. The read-back message now also carries the estimated expiry it substituted, so the value is visible rather than merely implied.The token builder's own skip in
ListProgrammaticAccessTokensdeliberately stays atDebug. That one fires once per user per sync and is exactly the per-resource case the same rules keep quiet.Stale docs note
The service-user
<Note>still said the connector "verifies that role is actually granted to the user first". Since #149 that check is best-effort — when the connector's role cannot runSHOW GRANTS TO USERit is skipped and Snowflake rejects an ungranted role itself. Softened to match, and the two failure modes are now stated separately rather than collapsed into one sentence.Verification
go test ./pkg/...andgolangci-lint run ./pkg/...are clean. No behaviour change beyond log level and log fields, so no new tests.