fix: AJDA-3010 make data-apps migration command usable stack-wide#103
Open
sykora-ji wants to merge 4 commits into
Open
fix: AJDA-3010 make data-apps migration command usable stack-wide#103sykora-ji wants to merge 4 commits into
sykora-ji wants to merge 4 commits into
Conversation
added 2 commits
July 17, 2026 11:23
… token Without an explicit componentAccess grant, projects that restrict component access by default reject listComponentConfigurations for keboola.orchestrator and keboola.flow with a 403, breaking the dry-run and force migration on those projects.
…tion migrateAllProjects called listOrganizationProjects unguarded, so a 401 from an organization the Manage token can't access (e.g. it isn't a member/admin there) crashed the whole "all" run instead of skipping that organization.
Contributor
There was a problem hiding this comment.
Pull request overview
Improves the reliability of the manage:migrate-data-apps-orchestrator-tasks operations command when running against an entire stack by ensuring it can scan restricted projects and won’t abort the whole run when encountering an inaccessible organization.
Changes:
- Add explicit
componentAccessgrants to the short-lived per-project Storage token so config listing/reads work on projects with restricted default component access. - Guard organization project listing with exception handling so stack-wide runs can continue past inaccessible organizations.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…rror Addresses Copilot review feedback on #103: catching any ManageClientException around listOrganizationProjects would also swallow transient/server-side failures (429/5xx), silently under-reporting the migration scope. Rethrow anything that isn't an authorization error.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes two bugs in
manage:migrate-data-apps-orchestrator-tasks(from #101 / AJDA-2445) found while actually running the dry-run against a real stack for AJDA-3010:createProjectStorageTokendidn't grantcomponentAccess, so on projects that restrict component access by default the command's own temporary token got a403 "You don't have access to the resource."when listingkeboola.orchestrator/keboola.flowconfigs — the dry-run couldn't scan anything on those projects.migrateAllProjects(<projects>=all) calledlistOrganizationProjectsunguarded, so a401from an organization the Manage token can't access crashed the entire stack-wide run instead of skipping that org and continuing.Also adds
AGENTS.md/CLAUDE.mddocumenting the repo's architecture and conventions for AI coding agents (doc-only, unrelated to the fixes above).Test plan
vendor/bin/phpunit tests/MigrateDataAppsOrchestratorTasksTest.phpkeboola.flowconfig referencingkeboola.data-appsnow correctly reports the task as migratable, where it previously failed with the 403 above.<projects>=allon North Europe no longer crashes on encountering an inaccessible organization.