[stopachka]

Instant manages its internal system namespaces, and apps can't write rules for them. This makes rule resolution match that: these namespaces now always use their built-in rules, rather than going through the general lookup.

$users, $files and $streams accept custom rules, so they resolve as before.

Admin access and auth flows don't go through these rules and are unchanged.

Test plan

• Added a unit test in rule_test.clj
• Server test suite passes

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

Rule compilation now uses only the entity fallback path for non-editable system entity types. Other types retain entity-specific and $default allow paths before fallback. Tests check $default inheritance for editable system types and "false" for other system types.

Changes: System entity rule handling

Layer / File(s)	Summary
Rule path selection and validation server/src/instant/model/rule.clj, server/test/instant/model/rule_test.clj	A helper identifies non-editable system entity types. get-program! uses only the fallback path for these types. The test checks $default inheritance for editable system types and expects "false" for other system types.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: tonsky

Merge Risk: Minimal · up to 99b33

The rule-resolution change matches the system catalog and preserves custom rules for editable namespaces; no actionable merge risk remains.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn