Skip to content

Migrate off deprecated trait profile/status attributes - #57

Merged
laurenleach merged 1 commit into
mainfrom
lauren/migrate-deprecated-trait-attrs
Aug 15, 2026
Merged

Migrate off deprecated trait profile/status attributes#57
laurenleach merged 1 commit into
mainfrom
lauren/migrate-deprecated-trait-attrs

Conversation

@laurenleach

Copy link
Copy Markdown
Contributor

baton-sdk v0.20.6 moved profile, status, and created_at off the trait
messages onto attributes on Resource, deprecating the trait-level options and
getters. staticcheck flags every remaining call with SA1019, so verify / lint
is red on main.

This migrates the connector to the resource-level API:

  • With{User,Group,Role,App}Profile -> WithResourceProfile
  • WithStatus / WithDetailedStatus -> WithResourceStatus
  • WithCreatedAt / WithSecretCreatedAt -> WithResourceCreatedAt
  • trait GetProfile() / GetStatus() reads -> the equivalent read on the resource

The option type changes from a *TraitOption to a ResourceOption, so the calls
move out of the trait slice and into the variadic tail of the New*Resource call.
The two status enums are numerically identical, so the values map 1:1. Non-deprecated
trait data (login, aliases, emails, secret type/expiry) is untouched.

No behavioural change intended: the deprecated options already populated the
resource-level fields. golangci-lint run ./... reports 0 issues after this
change, and the package tests pass.

Comment thread pkg/connector/user.go
user.ID,
userTraitOptions,
sdkResource.WithResourceProfile(profile),
sdkResource.WithResourceStatus(v2.Status_RESOURCE_STATUS_ENABLED, ""),

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Suggestion: The profile/status emission path changed shape here (trait-level → resource-level), but user_test.go only covers accountRole, so nothing asserts what userResource actually produces. Consider a small table test asserting sdkResource.GetProfile(res) contains user_role/user_id and sdkResource.GetStatus(res).GetStatus() == v2.Status_RESOURCE_STATUS_ENABLED — that pins the behavior the Grants path depends on. (confidence: high that coverage is absent; the migration itself reads correct)

Comment thread pkg/connector/role.go
roleTraitOptions := []resource.RoleTraitOption{
resource.WithRoleProfile(profile),
}
roleTraitOptions := []resource.RoleTraitOption{}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Suggestion: Now that the profile moved to WithResourceProfile, this slice is always empty — the local variable is dead scaffolding. Passing nil directly to resource.NewRoleResource(...) is clearer. Same applies to project.go:40 and team.go:43.

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Connector PR Review: Migrate off deprecated trait profile/status attributes

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 185bae20ca22.
Review mode: full
View review run

Review Summary

Scanned the full PR diff for security and correctness. This is a behavior-preserving migration of user.go, team.go, project.go, and role.go off the deprecated trait-level WithUserProfile/WithGroupProfile/WithRoleProfile/WithStatus options onto the resource-level WithResourceProfile/WithResourceStatus, with the matching read sites moved to resource.GetProfile(resource). Verified against the vendored SDK (v0.22.0): the New*Resource constructors append the trait option last and sync*TraitToResource only fills unset resource fields, so the explicit resource-level values win and are not clobbered; the now-empty trait-option slices still attach the group/role/user trait annotations, so trait presence is preserved; Status_RESOURCE_STATUS_ENABLED and UserTrait_Status_STATUS_ENABLED are both 1, so the status maps 1:1; GetProfile falls back to the deprecated trait profile, so previously synced data still reads; and GetProfileStringValue is nil-safe, so the removed GetUserTrait/GetGroupTrait error checks are covered by the existing not-present branches. No deprecated trait profile/status calls remain under pkg/ or cmd/, and go.mod/go.sum were untouched — the pinned SDK already provides these APIs. No security or correctness issues found.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

  • pkg/connector/user.go:128 — no test covers the changed profile write/read pairing that Grants depends on (medium confidence, non-blocking).
Prompt for AI agents
Verify each finding against the current code and only fix it if needed.

## Suggestions

In `pkg/connector/user.go`:
- Around line 128: The user role is now written with sdkResource.WithResourceProfile(profile) in
  userResource and read back with sdkResource.GetProfile(resource) in Grants. That write/read
  pairing is the only thing this refactor could silently break, and pkg/connector/user_test.go
  currently only covers CreateAccount and Delete. Add a test that builds a linear.User, calls
  userResource(...), then calls Grants on a userResourceType and asserts it returns exactly one
  grant whose entitlement is the member entitlement on the expected role resource
  (owner/admin/guest/user). Optionally assert that
  sdkResource.GetProfileStringValue(sdkResource.GetProfile(res), userRoleProfileKey) returns the
  expected role and that the resource-level status is v2.Status_RESOURCE_STATUS_ENABLED.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocking issues found — see review comments.

@laurenleach
laurenleach force-pushed the lauren/migrate-deprecated-trait-attrs branch from ca27f66 to a772c25 Compare August 14, 2026 23:57

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No blocking issues found.

baton-sdk v0.20.6 moved `profile`, `status`, and `created_at` off the trait
messages onto attributes on `Resource`, deprecating the trait-level options and
getters. staticcheck flags every remaining call with `SA1019`, so `verify / lint`
is red on `main`.

This migrates the connector to the resource-level API:

- `With{User,Group,Role,App}Profile` -> `WithResourceProfile`
- `WithStatus` / `WithDetailedStatus` -> `WithResourceStatus`
- `WithCreatedAt` / `WithSecretCreatedAt` -> `WithResourceCreatedAt`
- trait `GetProfile()` / `GetStatus()` reads -> the equivalent read on the resource

The option type changes from a `*TraitOption` to a `ResourceOption`, so the calls
move out of the trait slice and into the variadic tail of the `New*Resource` call.
The two status enums are numerically identical, so the values map 1:1. Non-deprecated
trait data (login, aliases, emails, secret type/expiry) is untouched.

No behavioural change intended: the deprecated options already populated the
resource-level fields. `golangci-lint run ./...` reports 0 issues after this
change, and the package tests pass.
@laurenleach
laurenleach force-pushed the lauren/migrate-deprecated-trait-attrs branch from a772c25 to 37b45fc Compare August 15, 2026 00:02
Comment thread pkg/connector/user.go
return nil, "", nil, fmt.Errorf("list-grants: Failed to get user trait from user: %w", err)
}
userProfile := userTrait.GetProfile()
userProfile := sdkResource.GetProfile(resource)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Suggestion: The read path for the role profile key moved from the user trait to the resource, which is the one place this refactor could silently regress (Grants would fail with "user role was not present on profile"). user_test.go only covers CreateAccount/Delete — consider a small test that builds userResource(...) and asserts Grants still emits the role membership grant, so the write/read pairing is locked in.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No blocking issues found.

@laurenleach
laurenleach merged commit e180ed8 into main Aug 15, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant