Repository navigation
fix(access): verify and name policy-sharing neighbours before removal - #55
Merged
Merged
Conversation
✅ Cyclops Security Review: safe to merge✅ Reviewed 486c977 (latest) · Coverage: full · no open findings · report
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
…keep RPC groups whole
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #54, tightening how
pnpm earn access removefinds and checks stacks that share a TIP-403 policy.loadEarnProfileBundle), not the authored profile alone, so a neighbour whose profile no longer matches its record stops the removal instead of being skipped. Neighbours on another genesis of the same chain ID are ignored.deployment.pending.jsonon the same chain and policy stops the removal: its contracts may already be bound to the policy.existsSyncreplacesDirent.isDirectory.profile.json, names the profile and includes the underlying reason in the message, not only incause..env.<id>now wins over the shell.TEMPO_RPC_URL/USERNAME/PASSWORDcome from it as a group when it sets any, so a shell endpoint is never paired with a neighbour's credentials.Tests: new
cli.test.tscovers unpublished, unparseable and symlinked neighbours, plus a membership case for naming the blocking stack.pnpm check,pnpm check:typesandpnpm --filter @tempoxyz/contracts test --run(755 passed) pass locally.