Offer environments in the resource grant picker - #140
Merged
Conversation
networks 0.4.0 added the environment principal and the Console never learned about it: the picker built its options from users, agents, apps and groups, and formatPrincipalType had no case for one, so a grant made by any other means rendered as "Unspecified" -- a working grant labelled as though it were broken. An environment is the only principal that reaches a sandbox, so leaving it out of the picker left the whole reason it exists unreachable from the UI. Its option says what it reaches rather than repeating its name. "Every workload running it, including sandboxes" is the part that is not obvious from a row that otherwise looks like every other principal.
The install moved out of "platform"; that namespace is empty now, so the patch and sync looked for a deployment that was no longer there.
vitramir
force-pushed
the
grant-to-environment
branch
from
August 10, 2026 07:38
a33a9f7 to
d071d7d
Compare
A name field and a create-and-grant button sat under the principal picker, making a group out of band and granting it in one step. It is a second way to create a group, in a dialog about granting access, and it is the only control here that writes a resource of its own. The picker already lists every group in the organization; making one belongs on the groups surface.
This was referenced Aug 12, 2026
vitramir
added a commit
that referenced
this pull request
Aug 14, 2026
…ade matter (#147) * Provision E2E on the platform VM The pinned bootstrap action built a k3d cluster through Terraform, and the k3d provider it needs is no longer served: "Error while installing agynio/k3d v0.2.3: could not query provider registry". Nothing has reached the tests since. DevSpace already points at agyn-platform, from #140. * Environments carry a persistent shells setting The field existed on the API with nothing to set it, so an operator could not reach it at all. It goes on the environment dialog beside LLM access and availability -- the other two things that decide what a workload here can do. A Select rather than a toggle because the kit has no switch, and the helper text carries the part that is easy to get wrong: shells survive losing a connection, they do not survive the workload stopping. Defaults on, matching the API, so creating an environment without an opinion gets the behavior people expect from a machine they connect to. * Pin the order sign-out has to run in The fix itself went in with e13ee47, which swept it up alongside unrelated work; this is the guard it should have carried. signoutRedirect() reads the stored user for id_token_hint and removes the user itself, so clearing first only costs the hint -- and Dex answers 400 to a post_logout_redirect_uri that arrives without one. Removing the user early also drops isAuthenticated while the session is still live, which lets RequireAuth sign straight back in against it, so the click reads as a page reload rather than a sign-out. Both assertions fail against the pre-fix UserContext: the first on the call order, the second on the local path not navigating.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
networks0.4.0 added theenvironmentprincipal and the Console never learned about it.Two gaps:
formatPrincipalTypehad no case for it, so a grant made by any other means rendered as "Unspecified": a working grant labelled as though it were broken.The option's description says what the grant reaches — "Every workload running it, including sandboxes" — rather than repeating the name. That reach is the part that is not obvious from a row that otherwise looks like every other principal.
Added a test that walks the enum and asserts every principal has a name, so the next one added to the proto fails here rather than rendering as "Unspecified".
292 tests pass; the two lint warnings are pre-existing in a file this does not touch.