Repository navigation
feat(calls): read and change team call data retention - #22
Conversation
Add `calls retention get` and `calls retention set` for GET/PUT /platform/call-retention. The pinned SDK has no call-retention resource, so a CLI adapter (createCallRetentionClient) sends the requests through the organization client's raw transport. `set` requires --expected-revision, reads the setting first, fails with state_conflict (exit 4) on a stale revision, and asks for confirmation (or --yes; exit 2 confirmation_required without a terminal) before a shorter period deletes stored call data. 403 and 409 responses get actionable messages.
|
Warning Review limit reached
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Next included review available in 35 minutes. View limit detailsLimit details: You’ve used the included review currently available. Your 74 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (11)
Comment |
|
@coderabbitai review |
|
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 431b29fd61
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| async run(): Promise<void> { | ||
| const {flags} = await this.parse(CallsRetentionGet) | ||
| const result = await viewCallRetention( | ||
| createCallRetentionClient(await this.platformEnvironment(flags)), |
There was a problem hiding this comment.
calls retention get always uses platformEnvironment, whose resolver rejects POLYMORFA_PROJECT_TOKEN and project-token profiles before transport. This prevents authorized project-token users from reading the setting even though the API contract documented in docs/command-research/calls.md:89-91 explicitly permits project tokens; it also means calls retention set rejects such tokens locally with exit 2 instead of reaching the documented authorization failure with exit 3. Use credential resolution and a raw client that can preserve a project-token principal for this resource.
Useful? React with 👍 / 👎.
…nablement truthfully
calls retention get resolved Platform credentials, which accept only team
API keys, so project tokens were refused locally although the API lets them
read the team setting; calls retention set likewise refused them with exit 2
instead of reaching the API's 403 (exit 3).
Both commands now resolve a team API key or a project token, from the
environment or a profile, with no project context, and the API decides.
Team keys keep the SDK raw transport. The pinned SDK confines project-token
raw requests to /platform/projects/{id} and refuses a project token as an
organization key, so project tokens use a narrow single-request transport
that sends the SDK's headers, refuses non-loopback http and redirects, and
maps failures to the SDK error classes. Remove it once a pinned SDK release
serves this route (polymorfa/sdks#278).
Help text and README now say deletion starts on a date Polymorfa announces,
matching the API: the production purge is not enabled yet.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 44ddc255a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } from '../../../services/calls.js' | ||
|
|
||
| export default class CallsRetentionSet extends BaseCommand { | ||
| static override description = `Change how long Polymorfa keeps your team’s call data through the Platform API. --policy short, standard, extended, or compliance keeps call data for 7, 30, 90, or 365 days; --policy custom keeps it for --days (${MIN_CALL_RETENTION_DAYS} to ${MAX_CALL_RETENTION_DAYS}). Deletion of call data older than the period starts on a date Polymorfa announces in its changelog; until then saving a period deletes nothing. Once deletion runs, a shorter period also applies to call data already stored, and deleted call data cannot be recovered, so the command asks you to confirm a shorter period; pass --yes to confirm without a prompt (required when standard input or error is not a terminal). --expected-revision is required: the command reads the setting first and changes it only if it still has that revision (see \`calls retention get\`); otherwise it fails with state_conflict (exit code 4) and changes nothing. Requires a team API key with the sessions:manage scope; the API refuses project tokens (exit code 3).` |
There was a problem hiding this comment.
For a team key that has sessions:manage but not sessions:read, this help text claims the credential is sufficient, but updateCallRetention always performs client.retrieve() before attempting the PUT, and the read endpoint requires sessions:read. Such users therefore receive a 403 and can never make the otherwise-authorized change; either allow manage-only credentials through the preliminary read or state that this command requires both scopes.
Useful? React with 👍 / 👎.
…:manage calls retention set reads the setting before it changes it, and the API does not let sessions:manage imply sessions:read. The help text, README and command research now name both scopes, and a 403 on the preliminary read gets the change message instead of the read-only one.
# Conflicts: # docs/command-research/calls.md
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a98c4a4174
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| pinned SDK has no call-retention resource. `createCallRetentionClient` in | ||
| `src/sdk/client.ts` sends `GET` and `PUT /platform/call-retention` through | ||
| the SDK organization client's raw transport for team API keys. The pinned | ||
| SDK confines a project-token client's raw paths to `/platform/projects/{id}` | ||
| and refuses a project token as an organization key, so project tokens use |
There was a problem hiding this comment.
This section describes an implementation that is absent from the final tree: createCallRetentionClient in src/sdk/client.ts now calls the pinned SDK's createTeamCallRetentionClient for both credential types, while src/sdk/project-token-request.ts no longer exists. Leaving the research guide saying the SDK lacks this resource and recommending a future migration can mislead subsequent maintenance; update this section and the operation table to reflect the typed SDK integration.
Useful? React with 👍 / 👎.
|
@codex review |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
# Conflicts: # package-lock.json # package.json
|
@codex review |
|
@codex review |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: df89c75c01
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| typeof current.retentionDays !== 'number' || | ||
| retentionDays < current.retentionDays | ||
| ) { | ||
| await confirmShorter(current, retentionDays) |
There was a problem hiding this comment.
When a project token requests a shorter period (for example, --policy short from the 90-day default), updateCallRetention invokes confirmation before sending the PUT; therefore a noninteractive call without --yes exits 2 with confirmation_required, and an interactive user is prompted to approve a change they cannot make, instead of receiving the documented API refusal with exit 3. Although the new credential resolver fixes the previous blanket project-token rejection, this shorter-policy path is fresh evidence that some project-token changes still do not reach the API as promised.
Useful? React with 👍 / 👎.
|
Merge gate for |
polymorfa calls retention getreads the team's call-data retention setting.calls retention setchanges it with a required--expected-revision, validates named and custom periods, and asks for confirmation before shortening the period. A stale revision exits 4; missing authority exits 3 with an actionable message. Team API keys can read and change the setting. Project tokens can read it without supplying a project ID; the API rejects their changes.The CLI uses the typed
@polymorfa/sdkteam-wide retention client for both credentials. This replaces the temporary raw request bridge. The dependency is pinned to@polymorfa/sdk@0.1.0-dev.20260923112126, published from SDK sourcee38db510a12b6e1ee7c36087f6b8267038509929(SDK dev merge4a1c97ab5210c9726c94a4dc8288292928950759). The CLI PR targetsdev.Verification
npm ci --ignore-scriptsandnpm run verifypass against the published SDK: format, lint, typecheck, 74 test files / 648 tests, build, package dry run, and production audit with 0 vulnerabilities. The downloaded SDK tarball's SHA-512 matches the registry metadata and lockfile integrity.API, SDK, CLI, docs, feature release, Admin
GETandPUT /platform/call-retentioncontract intodevat109ac4c110d8aabad1f95864c29bee31960a7d11. The CLI's request bodies, team scope, and 409/403 paths match the current route.dev; this CLI pins their published prerelease.calls retention get|set, help and examples, team-setting credential resolution, confirmation and error handling, and typed SDK integration.