Skip to main content
← Back to list
01Issue
BugShippedSwamp CLI
Assigneesstack72

Relationships

#1609 Grants directory loader skips symlinks — breaks Kubernetes ConfigMap mounts

Opened by stack72 · 8/11/2026· Shipped 8/11/2026

Description

The grants directory loader in grant_file.ts:197-198 uses e.isFile to filter directory entries:

const files = dirEntries
    .filter((e) => e.isFile && isGrantFileExtension(e.name))
    .sort((a, b) => a.name.localeCompare(b.name));

In Deno's readDir() API, symlinks have isFile: false and isSymlink: true. Kubernetes ConfigMap volumes materialise files as symlinks through a hidden ..data directory (the kubelet creates ..data -> ..2024_01_01_timestamp/ and then symlinks each key to ..data/<key>). Because the filter checks e.isFile only, every file in a ConfigMap-mounted grants directory is skipped, resulting in zero grants being loaded.

Steps to reproduce

  1. Mount a Kubernetes ConfigMap containing grants YAML files to the grants/ directory
  2. Start swamp serve with the grants directory
  3. Observe that no grants are loaded — the server starts with an empty policy

Alternatively, on any system:

mkdir -p /tmp/grants-real
echo 'grants: [{subject: "user:test", effect: allow, actions: [read], resource: "workflow:*"}]' > /tmp/grants-real/team.yaml
mkdir /tmp/grants-link
ln -s /tmp/grants-real/team.yaml /tmp/grants-link/team.yaml
# grants-link/team.yaml will not be loaded

Expected behaviour

The loader should follow symlinks and load the resolved files. The filter should be (e.isFile || e.isSymlink) with an extension check on the resolved target, or use Deno.stat() (which follows symlinks) to check entries.

Dot-files and dot-directories (..data, ..2024_01_01_*) should continue to be excluded — either via the extension filter (they don't end in .yaml/.yml) or via an explicit dot-prefix check.

Environment

  • Reported by: Xero (enterprise, self-hosting on EKS)
  • Deployment: ConfigMap → --grants-file directory mount
  • File: src/domain/access/grant_file.ts:197-198
  • No symlink tests exist in grant_file_test.ts
02Bog Flow
✓OPEN✓TRIAGED✓IN PROGRESS✓SHIPPED+ 1 MOREASSIGNED+ 2 MOREREVIEW+ 4 MOREPR_MERGED+ 2 MORESESSION_SUMMARIZED

Shipped

8/11/2026, 10:24:24 PM

Click a lifecycle step above to view its details.

03Sludge Pulse
stack72 assigned stack728/11/2026, 9:25:41 PM

Sign in to post a ripple.