testserver: 404 on permissions GET when V2 parent is gone#5186
Merged
janniklasrose merged 1 commit intomainfrom May 6, 2026
Merged
testserver: 404 on permissions GET when V2 parent is gone#5186janniklasrose merged 1 commit intomainfrom
janniklasrose merged 1 commit intomainfrom
Conversation
The recreated_same_name drift test asserted "update permissions" because the testserver returned an empty ACL for any object_id with no entry. The real cloud returns 404 for V2 permissions resources (verified for vector_search_endpoints and experiments), so the planner sees `remoteState == nil` and emits "create" instead. V1 resources (jobs, pipelines) retain ACL data after delete via async/soft delete, which the existing "empty ACL on miss" branch approximates well enough. Make GetPermissions check parent existence by default; for now only vector-search-endpoints has a parent lookup wired up. Update the test assertion and output to expect "create". Co-authored-by: Isaac
janniklasrose
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
janniklasrose
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
denik
approved these changes
May 6, 2026
5 tasks
janniklasrose
added a commit
that referenced
this pull request
May 6, 2026
## Summary - Reverts #5127 (`Persist endpoint UUID for vector_search_endpoints drift detection`) and the follow-up changelog entry from #5192. - The badness #5127 was meant to fix — bundle silently rebinding permissions to a different backing endpoint after an out-of-band recreate — was actually addressed by the testserver fix in #5186 (`testserver: 404 on permissions GET when V2 parent is gone`). With the testserver matching real V2 cloud behavior, bundle correctly observes that the new endpoint has no permissions and creates them, with no permanent drift afterwards. UUID persistence in state is no longer necessary. - Reworks the `drift/recreated_same_name` acceptance test: keeps endpoint permissions in `databricks.yml`, drops the obsolete "recreate detected" assertion, and adds a post-deploy `bundle plan` to confirm there is no permanent drift. ## Test plan - [x] `./task build` clean. - [x] `go test ./acceptance -run 'TestAccept/bundle/resources/vector_search_endpoints/drift'` — all green (terraform + direct). - [x] `go test ./bundle/direct/dresources/...` — green. - [x] `./task lint-q` — clean. - [x] Verified post-deploy plan shows `Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged` after an out-of-band endpoint recreate, so permissions don't end up in permanent drift even without UUID-based recreate detection. This pull request and its description were written by Isaac.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
testserver.GetPermissionsnow returns 404 when the parent object backinga permissions request is gone, defaulting to V2 permissions API behavior.
The check is wired up for
vector-search-endpointsonly; other resourcetypes fall through to the existing "empty ACL on miss" branch.
The acceptance test
bundle/resources/vector_search_endpoints/drift/recreated_same_namenow asserts
create(instead ofupdate) for the permissions resourcewhen the parent endpoint is recreated remotely with a different UUID, and
the recorded
output.txtis regenerated to match.Why
The integration variant of the test was failing with:
I confirmed the cloud behavior end-to-end against dogfood-aws:
There is a known inconsistency in how the cloud permissions API handles
deletion across resource types: V2 resources (vector search, experiments)
cascade-delete ACLs immediately and return 404 on subsequent GETs, while
V1 resources (jobs, pipelines) retain ACL data after the parent is deleted
via async/soft delete. The testserver previously matched neither
behavior — it returned an empty ACL for any unknown object id. The new
default is V2; V1 resources keep their existing fall-through.
When more V2 resources gain coverage that exercises this path, they
should add a case to
permissionsParentExists.Tests
go test ./acceptance -run 'TestAccept/bundle/resources/vector_search_endpoints'— green.go test ./acceptance -run 'TestAccept/bundle/resources/permissions'— green.go test ./libs/testserver/...— green../task lintand./task fmt— clean.This PR was written by Claude Code.