Repository navigation
docs: correct the locked-project restriction and document the undocumented sync limits - #59
Conversation
…ented sync limits Restate the comma and ampersand restriction as one on filter values rather than on project names, and retype it as a note: Tableau accepts both characters in a project name and rejects them inside a filter expression. Document, on the customer-facing page, the limitations the README and docs-info.md already recorded: Personal Space workbooks are not synced, the All Users group cannot be changed through the API, Server Administrator users are skipped during group membership sync, and a license revoke fails against a group's minimum site role. Document that revoking a permission a user holds only through a group leaves the access in place. Correct the frontmatter description to the provisioning variant and match og:description to it, and correct the README's permission counts and project entitlement names to the slugs the connector emits. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
238053a to
29c468b
Compare
Superseded — see the current review report for commit
|
Superseded — see the current review report for commit
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
No blocking issues found — see the full review report
| </Note> | ||
|
|
||
| <Note> | ||
| Tableau does not allow a site role lower than the minimum site role of any group the user belongs to. Revoking a license from a user who belongs to a group configured with **Grant role on sign in** fails with the error `Site role of link user that belongs to license upon login cannot be lower than minimum site role of group`. Remove the user from that group first, then revoke the license. |
There was a problem hiding this comment.
Lead with the action and the fix; the error string is useful for search, so keep it. Also, the PR body says this is inferred from docs-info.md rather than reproduced. Was it reproduced against a live site?
| Tableau does not allow a site role lower than the minimum site role of any group the user belongs to. Revoking a license from a user who belongs to a group configured with **Grant role on sign in** fails with the error `Site role of link user that belongs to license upon login cannot be lower than minimum site role of group`. Remove the user from that group first, then revoke the license. | |
| Revoking a license fails if the user belongs to a group with a **Grant role on sign in** minimum site role. Tableau returns `Site role of link user that belongs to license upon login cannot be lower than minimum site role of group`. Remove the user from that group first, then revoke the license. |
There was a problem hiding this comment.
Applied in eaa552c.
On the question: no, it was not reproduced against a live site. It came from the error string recorded in docs/docs-info.md:210, which is this repo's own prose rather than a Tableau source, so it was the wrong thing to lean on.
Tableau documents the constraint itself: Grant Role on Sign In, and this KB article records the same failure with the same remedy, remove the user from the group or turn the setting off. The PR description now cites those two instead of docs-info.md.
The connector carries no guard of its own: a grep over pkg/ for the minimum site role returns nothing.
… All Users claim README said Grant and Revoke are unsupported on the All Users group. Grant returns GrantAlreadyExists (pkg/connector/group.go:141-145), so it succeeds as a no-op and only Revoke errors. Frontmatter keeps "Salesforce Tableau" in og:description and description, so all five fields match the name #47 aligned with the docs site. The locked-project and group-revoke Notes move below the "Permission inheritance" list: a Note between bullets splits the list when rendered. Remaining edits shorten the Notes bullets and state the effect instead of the mechanism. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Superseded — see the current review report for commit
|
Connector PR Review: docs: correct the locked-project restriction and document the undocumented sync limitsBlocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0 Review SummaryThis PR only touches documentation ( Security IssuesNone found. Correctness IssuesNone found. Suggestions
Prompt for AI agentsReviewed commit: |
There was a problem hiding this comment.
No blocking issues found — see the full review report
Summary
The connector page told readers that Tableau does not allow commas or ampersands in project names. Tableau accepts both in a name and rejects them inside a filter value, which is what the connector builds from the project name. The page now states the restriction correctly, and carries the operational limits that until now existed only in the README and in
docs/docs-info.md.Findings addressed
Core Exp, Nav, and Search,Sales & MarketingandR&D, Labswere all created and kept with those characters in their names. Code side verified againstpkg/client/helpers.go:104-106andpkg/connector/project.go:204. Retyped from<Warning>to<Note>, since it describes a limitation rather than a destructive action.pkg/connector/workbook.go:72-76. The README already documented this and is unchanged on that point.descriptionandog:descriptiondisagreed, and the description used the no-provisioning variant while every row of the capabilities table carries a Provision checkmark — verified against the table andbaton_capabilities.json.pkg/connector/workbook.go:13-29, which lists 16 includingExtractRefresh.Read, Write, which are the Tableau API capability names rather than the entitlement slugs the connector emits — verified againstpkg/connector/project.go:16,20-27andpkg/connector/helpers.go:41,60-62:View,Publish, and 16Workbook / ...entitlements.GrantAlreadyExistsand only Revoke errors, and Server Administrator users are skipped during group membership sync — verified atpkg/connector/group.go:141-145,173-175and:112-116. A license revoke fails against a group's minimum site role — documented by Tableau for groups with Grant Role on Sign In, and its SCIM knowledge-base article records the same failure and the same remedy; the connector carries no guard of its own.Why
A reader checking the first claim finds that Tableau accepts the characters the page says it forbids, and concludes the limitation does not apply to their site. The group-revoke gap is the costlier one: an administrator removes a permission, the task reports success, and the user keeps the access until someone notices on a later review.