feat(faro): Add exports and projections by moshloop · Pull Request #3405 · flanksource/mission-control

moshloop · 2026-08-10T07:36:01Z

What

Add configurable access exports and multi-context by-user reports.
Add Faro projection commands with CEL queries, target mappings, validation, dry runs, and YAML updates.
Extend SDK catalog-change filtering and exact totals with fixtures and focused tests.

Why

Support configurable access reporting and projection workflows for config, identity-access, and permission-change data.

…h tokens Treat skipped database probes as optional and surface detailed auth or database failures for actionable diagnostics. BREAKING CHANGE: OIDC refresh is now opt-in; pass --refresh to spend a single-use refresh token. Claude-Session-Id: 4ee06f93-f1d6-414c-8cbd-3199fd82c1f3

Separate credentials from config.json and protect rotating refresh-token exchanges with atomic writes and cross-process locking. Persist the selected file or OS keychain backend, migrate legacy inline secrets, cache OIDC endpoints, and mark terminal invalid_grant failures for re-authentication.

Extract boolean flag and server-side filter parsing into clientcmd so catalog and access commands share one implementation. This removes duplicated parsing logic and keeps defaults and filter labels consistent.

Add remote access auditing for permissions, users, groups, roles, sign-in logs, and reviews with MatchItem filtering, rollups, group expansion, and machine-readable exports. Normalize filter middleware to preserve case-insensitive alternatives, exclusions, repeated values, and malformed-filter errors.

Make faro version output identify the source revision, build time, toolchain, platform, and dirty state across stamped and direct Go builds. Add a machine-local build and install workflow with an overridable destination.

Split oversized access-filter requests into bounded batches while preserving merged ordering, limits, and totals. Return malformed search filters as structured JSON bad requests for consistent client handling.

Make authentication diagnostics validate refreshed OIDC credentials by default. This changes whoami to consume single-use refresh tokens unless disabled explicitly. BREAKING CHANGE: whoami now refreshes OIDC tokens by default

…tics Provide governance consumers with deterministic identity-register exports containing external users, memberships, and access grants. Bound each whoami endpoint attempt independently and report all failed candidates, making authentication failures actionable.

Add configurable identity classification, canonical workload principals, schema-safe contact handling, and projection warnings to access exports. Introduce multi-context by-user access reports with register owner folding, people filtering, and detail views.

Add multi-document Projection manifests with CEL-based source queries, target matching, JSONPath mappings, validation, dry runs, and YAML updates. Support config, identity-access, and permission-change projections while preventing incomplete bounded audit results. Extend the SDK with filtered catalog-change listing and exact totals, plus fixtures and focused tests.

coderabbitai · 2026-08-10T07:36:13Z

Warning

Review limit reached

@moshloop, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 16 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bc659fb3-9264-4ba4-989d-2e931ae747e5

📥 Commits

Reviewing files that changed from the base of the PR and between 033539e and 707fe91.

⛔ Files ignored due to path filters (1)

go.sum is excluded by !**/*.sum

📒 Files selected for processing (81)

Makefile
auth/oidcclient/oidcclient.go
clientcmd/api_client.go
clientcmd/auth_login.go
clientcmd/auth_login_test.go
clientcmd/context.go
clientcmd/context_credentials.go
clientcmd/context_credentials_test.go
clientcmd/context_test.go
clientcmd/credentials/file.go
clientcmd/credentials/file_test.go
clientcmd/credentials/keychain.go
clientcmd/credentials/keychain_test.go
clientcmd/credentials/lock.go
clientcmd/credentials/store.go
clientcmd/credentials/suite_test.go
clientcmd/flags.go
clientcmd/refresh_test.go
clientcmd/whoami.go
clientcmd/whoami_test.go
clientcmd/whoami_token.go
cmd/access_groups.go
cmd/access_roles.go
cmd/access_users.go
cmd/catalog_entity.go
cmd/catalog_get.go
db/middleware.go
db/middleware_test.go
faro/access.go
faro/access_export.go
faro/access_export_test.go
faro/access_filter_test.go
faro/access_groups.go
faro/access_help.go
faro/access_help_test.go
faro/access_identity_type.go
faro/access_logs.go
faro/access_permissions.go
faro/access_principal.go
faro/access_print.go
faro/access_report.go
faro/access_report_test.go
faro/access_reviews.go
faro/access_roles.go
faro/access_rollup.go
faro/access_rows.go
faro/access_test.go
faro/access_users.go
faro/catalog_help.go
faro/main.go
faro/projection.go
faro/projection_apply.go
faro/projection_cel.go
faro/projection_create.go
faro/projection_query.go
faro/projection_test.go
faro/projection_types.go
faro/projection_verify.go
faro/projection_yaml.go
faro/projection_yaml_test.go
faro/register_read.go
faro/suite_test.go
faro/version.go
faro/version_test.go
fixtures/projection/README.md
fixtures/projection/target.schema.json
fixtures/projection/target.yaml
fixtures/projection/trust-center.yaml
go.mod
sdk/access.go
sdk/access_batch.go
sdk/access_batch_test.go
sdk/access_filter.go
sdk/access_filter_test.go
sdk/access_history_test.go
sdk/access_identity.go
sdk/access_logs.go
sdk/access_test.go
sdk/catalog.go
sdk/catalog_test.go
sdk/client.go

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-08-10T07:36:30Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/github.com/gofrs/flock@v0.13.0
	golang/github.com/zalando/go-keyring@v0.2.8

View full report

moshloop added 11 commits August 6, 2026 17:05

refactor(clientcmd): Centralize shared CLI flag parsing helpers

fea947f

Extract boolean flag and server-side filter parsing into clientcmd so catalog and access commands share one implementation. This removes duplicated parsing logic and keeps defaults and filter labels consistent.

feat(faro): Expose build metadata and local installation workflow

c503231

Make faro version output identify the source revision, build time, toolchain, platform, and dirty state across stamped and direct Go builds. Add a machine-local build and install workflow with an overridable destination.

chore: update generated and lock files

ed415db

fix(sdk): Batch access queries and return structured filter errors

f1a77ce

Split oversized access-filter requests into bounded batches while preserving merged ordering, limits, and totals. Return malformed search filters as structured JSON bad requests for consistent client handling.

Navigation Menu

Uh oh!

feat(faro): Add exports and projections - #3405

feat(faro): Add exports and projections#3405
moshloop wants to merge 11 commits into
mainfrom
feat/access-exports-projections

moshloop commented Aug 10, 2026

Uh oh!

coderabbitai Bot commented Aug 10, 2026

Review limit reached

Uh oh!

socket-security Bot commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

moshloop commented Aug 10, 2026

What

Why

Uh oh!

coderabbitai Bot commented Aug 10, 2026

Review limit reached

Uh oh!

socket-security Bot commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant