fix(permission): make the response key lossless and migrate its readers

[whoAbhishekSah]

Part of #1782 (the "blocked on a lossless replacement for the deprecated response fields" group).

Problem

The key response field (service.resource.verb) is the replacement for the deprecated namespace/name fields, but reading a key back was lossy in two ways:

• A permission name containing dots failed to split: the parser demanded exactly 3 dot-parts and returned empty strings for a key like database.instance.soft.delete.
• A namespace without a slash silently gained a /default suffix while the key was built, so the key read back as a different namespace than the stored one.

Because of that, three readers stayed on the deprecated fields (with //nolint:staticcheck): the permission reconciler, the permission CLI output, and the e2e assertions. This PR makes the key read back to the exact stored values and moves those readers onto it.

One behavior note: a create/update request whose key has more than 3 dot-parts used to be treated as "no key" and fall back to the deprecated request fields. It now parses to a name with dots and is rejected as an invalid name. (The request-side fallbacks themselves are being removed in #1885.)

Testing

• Unit tests for the parser (dot names, short keys, empty segments) and a key round-trip test.
• A transform test that a dot name survives and a slash-less namespace errors.
• Reconciler tests updated to serve key only, plus a test that an unsplittable key fails the run.
• go test on the touched packages and the full unit suite pass; the service registration e2e suite passes locally against Docker.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview	Aug 17, 2026 5:31am

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2e207c40-0c60-4da2-ac21-c9868f7cf7e1

📥 Commits

Reviewing files that changed from the base of the PR and between 7c10c55 and 1c8eef1.

📒 Files selected for processing (8)

• cmd/permission.go
• internal/api/v1beta1connect/permission.go
• internal/api/v1beta1connect/permission_test.go
• internal/bootstrap/schema/schema.go
• internal/bootstrap/schema/schema_test.go
• internal/reconcile/permission_reconciler.go
• internal/reconcile/permission_reconciler_test.go
• test/e2e/regression/service_registration_test.go

Included review availability: Your plan includes up to 2 reviews per rolling hour; 1 remains after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Permission names containing dots are now handled correctly.
  • Permission listings and views consistently derive names and namespaces from canonical keys.
  • Invalid permission keys are detected and reported instead of being processed incorrectly.
  • Reconciliation now safely handles malformed existing permissions without unintended changes.
  • Permission lookups use canonical keys for more reliable results.

Walkthrough

Permission handling now uses canonical keys as the source for permission namespace and name. Key parsing preserves dotted names and rejects malformed keys. Serialization and reconciliation validate keys before producing responses or applying changes. Tests cover parsing, round trips, reconciliation, and lookups.

Changes

Permission Key Migration

Layer / File(s)	Summary
Permission key parsing contract internal/bootstrap/schema/schema.go, internal/bootstrap/schema/schema_test.go	Bounded key parsing preserves dots in permission names and rejects empty or missing segments. Tests cover parsing and round trips.
Permission serialization and command output internal/api/v1beta1connect/permission.go, internal/api/v1beta1connect/permission_test.go, cmd/permission.go	Serialization validates generated keys. View and list output derive namespace and name from each key.
Reconciliation and lookup consumers internal/reconcile/permission_reconciler.go, internal/reconcile/permission_reconciler_test.go, test/e2e/regression/service_registration_test.go	Reconciliation parses existing keys and stops on malformed keys. Fixtures and regression lookups use canonical keys.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 1c8ee

The change makes permission keys lossless and updates their readers, with reported unit and end-to-end tests passing; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: rohilsurana

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 31998174748

Coverage increased (+0.04%) to 48.735%

Details

• Coverage increased (+0.04%) from the base build.
• Patch coverage: 7 uncovered changes across 1 file (14 of 21 lines covered, 66.67%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
cmd/permission.go	7	0	0.0%
Total (4 files)	21	14	66.67%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	40088
Covered Lines:	19537
Line Coverage:	48.74%
Coverage Strength:	15.66 hits per line

---

💛 - Coveralls

[whoAbhishekSah]

Tested live against a local server built from this branch (verified the running binary contains the new code paths).

• frontier export permission — read all 15 custom permissions through the new key-splitting path; output matched their exact stored namespace/name.
• Added sandbox/gadget:probe to the exported file. Dry run planned exactly 1 add and no spurious changes, meaning every existing permission matched its spec via key.
• Applied. Server returned key: sandbox.gadget.probe with namespace sandbox/gadget, name probe — exact match.
• Second dry run: Permission: no changes — full lossless round trip (spec → create via key → read back via key → diff clean).
• frontier permission view <id> prints the right NAME/NAMESPACE columns, now derived from the key.
• Cleanup: marked delete: true, dry run planned 1 delete, applied, verified gone from ListPermissions.