authz: add PermissionClient TODO for better type-safety

Signed-off-by: Mike Lewis <mtlewis@users.noreply.github.com>
2021-11-12 12:13:48 +00:00
parent f0124d29a9
commit f816f68bbe
1 changed files with 5 additions and 0 deletions
@@ -97,6 +97,11 @@ export class PermissionClient {
    requests: AuthorizeRequest[],
    options?: AuthorizeRequestOptions,
  ): Promise<AuthorizeResponse[]> {
+    // TODO(permissions): it would be great to provide some kind of typing guarantee that
+    // conditional responses will only ever be returned for requests containing a resourceType
+    // but no resourceRef. That way clients who aren't prepared to handle filtering according
+    // to conditions can be guaranteed that they won't unexpectedly get a CONDITIONAL response.
+
    const identifiedRequests: Identified<AuthorizeRequest>[] = requests.map(
      request => ({
        id: uuid.v4(),