fix(policy)!: Optional namespace on actions protos, NamespacedPolicy feature flag

service/integration/actions_test.go

@@ -187,6 +187,41 @@ func (s *ActionsSuite) Test_ListActions_FiltersCustomActionsByNamespace_Succeeds
 	s.False(foundSecond)
 }
 
+func (s *ActionsSuite) Test_ListActions_WithoutNamespace_ReturnsAcrossNamespaces_Succeeds() {
+	name := fmt.Sprintf("global-list-action-%d", time.Now().UnixNano())
+
+	inDefault, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name:        name,
+		NamespaceId: s.defaultNamespaceID(),
+	})
+	s.Require().NoError(err)
+
+	inOther, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name:        name,
+		NamespaceId: s.otherNamespaceID(),
+	})
+	s.Require().NoError(err)
+
+	list, err := s.db.PolicyClient.ListActions(s.ctx, &actions.ListActionsRequest{})
+	s.Require().NoError(err)
+
+	foundDefault := false
+	foundOther := false
+	for _, action := range list.GetActionsCustom() {
+		if action.GetId() == inDefault.GetId() {
+			foundDefault = true
+			s.Equal(s.defaultNamespaceID(), action.GetNamespace().GetId())
+		}
+		if action.GetId() == inOther.GetId() {
+			foundOther = true
+			s.Equal(s.otherNamespaceID(), action.GetNamespace().GetId())
+		}
+	}
+
+	s.True(foundDefault)
+	s.True(foundOther)
+}
+
 func (s *ActionsSuite) Test_ListActions_LegacyCustomAction_NamespaceProjection_Succeeds() {
 	legacy := s.f.GetCustomActionKey("custom_action_1")
 	assertLegacyProjected := func(list *actions.ListActionsResponse) {

service/policy/actions/actions.proto

@@ -12,6 +12,7 @@ import "policy/selectors.proto";
 */
 
 message GetActionRequest {
+  option (buf.validate.message).oneof = { fields: ["namespace_id", "namespace_fqn"], required: false };
   option (buf.validate.message).cel = {
     id: "namespace_required_for_name"
     message: "Either namespace_id or namespace_fqn must be provided when getting an action by name"
@@ -54,12 +55,14 @@ message GetActionResponse {
 }
 
 message ListActionsRequest {
-  // Required
-  option (buf.validate.message).oneof = { fields: ["namespace_id", "namespace_fqn"], required: true };
+  // Optional
+  option (buf.validate.message).oneof = { fields: ["namespace_id", "namespace_fqn"], required: false };
 
-  // ID of the namespace. Required if namespace_fqn is not provided.
-  string namespace_id = 1 [(buf.validate.field).string.uuid = true];
-  // FQN of the namespace. Required if namespace_id is not provided.
+  // ID of the namespace to scope results. If omitted, returns actions across namespaces.
+  string namespace_id = 1 [
+    (buf.validate.field).string.uuid = true
+  ];
+  // FQN of the namespace to scope results. If omitted, returns actions across namespaces.
   string namespace_fqn = 2 [
     (buf.validate.field).string = {
       min_len : 1

service/policy/actions/actions_test.go

@@ -240,13 +240,17 @@ func (s *ActionSuite) Test_GetAction_Fails() {
 }
 
 func (s *ActionSuite) Test_ListActions_Succeeds() {
+	reqNoNamespace := &actions.ListActionsRequest{}
+	err := s.v.Validate(reqNoNamespace)
+	s.Require().NoError(err)
+
 	reqPaginated := &actions.ListActionsRequest{
 		NamespaceId: validUUID,
 		Pagination: &policy.PageRequest{
 			Limit: 1,
 		},
 	}
-	err := s.v.Validate(reqPaginated)
+	err = s.v.Validate(reqPaginated)
 	s.Require().NoError(err)
 
 	reqPaginated.Pagination.Offset = 100
@@ -259,15 +263,9 @@ func (s *ActionSuite) Test_ListActions_Succeeds() {
 }
 
 func (s *ActionSuite) Test_ListActions_Fails() {
-	// missing namespace
-	req := &actions.ListActionsRequest{}
-	err := s.v.Validate(req)
-	s.Require().Error(err)
-	s.Require().Contains(err.Error(), errMessageOneof)
-
 	// invalid namespace id
-	req = &actions.ListActionsRequest{NamespaceId: "invalid-uuid"}
-	err = s.v.Validate(req)
+	req := &actions.ListActionsRequest{NamespaceId: "invalid-uuid"}
+	err := s.v.Validate(req)
 	s.Require().Error(err)
 	s.Require().Contains(err.Error(), errMessageUUID)
 

service/policy/db/queries/actions.sql

@@ -19,8 +19,12 @@ WITH resolved_namespace AS (
 counted AS (
     SELECT COUNT(a.id) AS total
     FROM actions a
-    JOIN resolved_namespace rn ON TRUE
-    WHERE a.is_standard = TRUE OR a.namespace_id = rn.id OR a.namespace_id IS NULL
+    LEFT JOIN resolved_namespace rn ON TRUE
+    WHERE
+        rn.id IS NULL
+        OR a.is_standard = TRUE
+        OR a.namespace_id = rn.id
+        OR a.namespace_id IS NULL
 )
 SELECT 
     a.id,
@@ -32,11 +36,12 @@ SELECT
     )) as metadata,
     a.is_standard,
     CASE
-        WHEN a.namespace_id IS NULL THEN JSON_BUILD_OBJECT(
+        WHEN a.namespace_id IS NULL AND rn.id IS NOT NULL THEN JSON_BUILD_OBJECT(
             'id', rn.id,
             'name', rn.name,
             'fqn', rn.fqn
         )
+        WHEN a.namespace_id IS NULL THEN NULL
         ELSE JSON_BUILD_OBJECT(
             'id', n.id,
             'name', n.name,
@@ -45,11 +50,18 @@ SELECT
     END AS namespace,
     counted.total
 FROM actions a
-JOIN resolved_namespace rn ON TRUE
+LEFT JOIN resolved_namespace rn ON TRUE
 LEFT JOIN attribute_namespaces n ON a.namespace_id = n.id
 LEFT JOIN attribute_fqns ns_fqns ON ns_fqns.namespace_id = n.id AND ns_fqns.attribute_id IS NULL AND ns_fqns.value_id IS NULL
 CROSS JOIN counted
-WHERE a.is_standard = TRUE OR a.namespace_id = rn.id OR a.namespace_id IS NULL
+WHERE
+    (
+        sqlc.narg('namespace_id')::uuid IS NULL
+        AND sqlc.narg('namespace_fqn')::text IS NULL
+    )
+    OR a.is_standard = TRUE
+    OR a.namespace_id = rn.id
+    OR a.namespace_id IS NULL
 ORDER BY a.created_at DESC
 LIMIT @limit_ 
 OFFSET @offset_;