fix(access-tools): drop dead action filter; page listGrants fully (CL-7465)

Author: TheGreatAxios

packages/access-tools/src/client.test.ts

@@ -97,6 +97,30 @@ test("listGrants passes filters through and reads the native page envelope", asy
   });
 });
 
+test("listGrants follows nextCursor so a full page plus one all return", async () => {
+  const all = Array.from({ length: 51 }, (_, i) =>
+    nativeGrant(`grant_${i + 1}`),
+  );
+  const seen: string[] = [];
+  const fetchImpl = (async (url: string | URL | Request) => {
+    const raw = String(url);
+    seen.push(raw);
+    if (raw.includes("cursor=page_2")) {
+      return Response.json({ data: all.slice(50), nextCursor: null });
+    }
+    return Response.json({ data: all.slice(0, 50), nextCursor: "page_2" });
+  }) as unknown as typeof fetch;
+
+  const grants = await listGrants(testConfig(fetchImpl), {
+    principalId: "prin_2",
+  });
+  expect(grants).toHaveLength(51);
+  expect(grants.map((g) => g.id)).toEqual(all.map((g) => g.id));
+  expect(seen).toHaveLength(2);
+  expect(seen[0]).toContain("principalId=prin_2");
+  expect(seen[1]).toContain("cursor=page_2");
+});
+
 test("grantAccess posts one native single-action body per action and parses single GrantResponse objects", async () => {
   const posted: unknown[] = [];
   const fetchImpl = (async (
@@ -191,7 +215,7 @@ test("revokeAccess treats a native 204 with no body as success", async () => {
   await revokeAccess(testConfig(fetchImpl), "grant_1");
 });
 
-test("a grant body without principalId is a shape error, never a null-linked grant", async () => {
+test("a grant body missing principalId is a shape error, never a null-linked grant", async () => {
   const { principalId: _link, ...linkless } = nativeGrant("grant_1");
   void _link;
   const fetchImpl = (async () =>

packages/access-tools/src/client.ts

@@ -154,37 +154,43 @@ export async function listPrincipals(
 export interface ListGrantsFilter {
   readonly principalId?: string;
   readonly resource?: string;
-  readonly action?: string;
 }
 
-/** Lists grants in the run's tenant, passing the given filters through as
- * the native `GET /grants` query params (`principalId`, `resource`,
- * `action`). */
+/** Lists every grant in the run's tenant matching the given filters,
+ * following the native `nextCursor` pages to the end — the mirror honors
+ * the same `principalId`/`resource` query params as the native
+ * `GET /grants`. */
 export async function listGrants(
   config: AccessToolClientConfig,
   filter?: ListGrantsFilter,
 ): Promise<ListedGrant[]> {
   const fetchImpl = config.fetchImpl ?? ((...args) => fetch(...args));
-  const params = new URLSearchParams();
-  if (filter?.principalId !== undefined)
-    params.set("principalId", filter.principalId);
-  if (filter?.resource !== undefined) params.set("resource", filter.resource);
-  if (filter?.action !== undefined) params.set("action", filter.action);
-  const query = params.size === 0 ? "" : `?${params.toString()}`;
-  const response = await fetchImpl(`${config.hubAccessUrl}/grants${query}`, {
-    headers: { ...authHeaders(config) },
-  });
-  if (!response.ok) {
-    await throwForStatus("Listing grants", response);
-  }
-  const body: unknown = await response.json();
-  const parsed = ListedGrantsResponse(body);
-  if (parsed instanceof type.errors) {
-    throw new Error(
-      `List-grants response did not match the expected shape: ${parsed.summary}`,
-    );
-  }
-  return parsed.data;
+  const grants: ListedGrant[] = [];
+  let cursor: string | null | undefined;
+  do {
+    const params = new URLSearchParams();
+    if (filter?.principalId !== undefined)
+      params.set("principalId", filter.principalId);
+    if (filter?.resource !== undefined) params.set("resource", filter.resource);
+    if (cursor !== undefined && cursor !== null) params.set("cursor", cursor);
+    const query = params.size === 0 ? "" : `?${params.toString()}`;
+    const response = await fetchImpl(`${config.hubAccessUrl}/grants${query}`, {
+      headers: { ...authHeaders(config) },
+    });
+    if (!response.ok) {
+      await throwForStatus("Listing grants", response);
+    }
+    const body: unknown = await response.json();
+    const parsed = ListedGrantsResponse(body);
+    if (parsed instanceof type.errors) {
+      throw new Error(
+        `List-grants response did not match the expected shape: ${parsed.summary}`,
+      );
+    }
+    grants.push(...parsed.data);
+    cursor = parsed.nextCursor ?? null;
+  } while (cursor !== null);
+  return grants;
 }
 
 /** Grants access by posting one native single-action `POST /grants` body