Repository navigation
feat(access): let a grant end on a date - #676
Merged
Merged
Conversation
A role in a namespace, a role on a collection and permission on an asset
take an optional expires_at, set when giving them (an "Until" day in the
web app, expires_at in the API, until on the assistant's change_person)
and changed by giving them again or PATCH /resources/{rid}/permissions/
{account}. The three lookups every check reads grants through leave out
ended ones, so an ended grant opens nothing anywhere; lists mark it
expired.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFUNzy1QZy5HhKAyJxTAYJ
adeelahmad
force-pushed
the
claude/project-thread-xfmkzn
branch
from
October 19, 2026 06:03
335e9e8 to
1610b32
Compare
18 of 23 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please che
2D45
ck back later.
Requested by Adeel · project thread
Description
Before: access given to someone (a role in a namespace, a role on a collection, permission on an asset) lasted until an owner remembered to take it away.
After: each of those grants takes an optional end date: an "Until" day in the asset's Access dialog, a collection's People and a namespace's members,
expires_atin the API, anduntilon the assistant'schange_person. After that day the grant opens nothing anywhere access is checked, and lists show it as expired until it's given again or taken away. The field starts empty, so grants without an end work as before.How:
access.py,roles.pyandhierarchy.pyskip grants whoseexpires_athas passed; the routes, schemas and assistant tool take the date; the web app adds an Until field to the three places grants are given.tests/api/test_scaling_agents.pynow setsai.context_tokensto 64000. The admin's 80 tools take about 11,000 tokens of the default 16,000-token window, and the newuntilfield pushed the scaling read past what fit, so it was cut and the test'sjson.loadsfailed. The product gap is filed as #677.Motivation and Context
Item from the personal feature plan sheet ("share with someone for a week").
Screenshots (if appropriate):
n/a
Steps to reproduce (if appropriate):
Share an asset with someone with Until set to yesterday: they can't open it, and the Access dialog shows the grant as expired.
Types of changes
!in the title)Checklist:
make hookschecks it on commit).tests/api/test_grant_ends.py,tests/api/test_setup_assistant.py,__tests__/access-until.test.ts).docs/accordingly (docs/access.md, Grants that end;docs/api.md).## UnreleasedinCHANGELOG.md. Written aschangelog.d/grant-expiry.md, per build(release): changelog fragments in changelog.d/ instead of one Unreleased section #581.Done questions (AGENTS.md)
expires_atin the API anduntilonchange_person..envedit or manual step.expires_atis a new optional field; existing grants have none and never end.make openapi).Local CI (
ci/local-ci.sh): FastAPI embedded, Next.js, pre-commit and PR title passed. The server-mode job timed out on SurrealDB handshakes in this container; GitHub CI on this head passed it.test_scaling_agents.pypasses locally after the fix (5 passed).🤖 Generated with Claude Code
https://claude.ai/code/session_01QFUNzy1QZy5HhKAyJxTAYJ