fix(sdk): preserve metadata list request scope - #755
Conversation
Restrict positional list pagination to limit and offset, then serialize authoritative identity and status fields last so runtime extras cannot redirect a request to another scope. Test: npm test Test: npm run build Test: npm pack --dry-run --json Signed-off-by: RerankerGuo <121015044+RerankerGuo@users.noreply.github.com>
|
Hi @RerankerGuo ! |
|
Hi @Maxwell-Code07, yes. These contributions were prepared with AI-assisted coding tools under my supervision. I used the tools for repository analysis, implementation, and test generation, while checking each patch against the current I understand that the submission volume creates a substantial review burden. I will pause additional submissions to this repository while the existing batch is reviewed, prioritize responding to maintainer feedback, and close or consolidate anything you identify as duplicate or outside the project roadmap. Thanks for raising this directly. |
|
Follow-up on the August 3 batch: I completed a contributor-side cleanup to reduce maintainer review burden. I am closing this PR and the other non-retained submissions, and will keep only #179, #182, and #193 active because they have the strongest independent validation or prior maintainer signal. I will limit further work here to rebasing, testing, and responding to feedback on those three PRs. Thanks again for raising the submission volume concern directly. |
2 participants
Description | 描述
The TypeScript metadata SDK's positional list overloads previously spread the
pagination object after authoritative identity fields. JavaScript callers, or
TypeScript callers using a cast, could therefore supply runtime extras such as
team_id,user_id, orasset_idand redirect a request away from the scopespecified by the positional argument.
This change narrows positional pagination serialization to the declared
limitandoffsetfields, then writes identity and status arguments last.Regression coverage verifies all eight affected list methods at the transport
boundary.
Scope is limited to positional convenience overloads. Request-object overloads,
public types, endpoint paths, and valid pagination behavior are unchanged.
Related Issue | 关联 Issue
No linked issue. This defect was found during an SDK request-serialization
audit.
Change Type | 修改类型
Self-test Checklist | 自测清单
Additional Notes | 其他说明
Validation:
npm test -- tests/v3-metadata-pagination-scope.test.ts(8 passed)npm test(8 passed)npm run buildnpm pack --dry-run --json(44 files)git diff --check