From 3ef353de83a9a8157d64688269df06749443696e Mon Sep 17 00:00:00 2001 From: Ajay Ghanwat Date: Tue, 4 Aug 2026 21:20:11 +0530 Subject: [PATCH] docs: use JSON.stringify for codegen escaping in the Task 12 plan The plan's union helper hand-rolled escaping for backslash and double quote only. Role names reach the emitter through the raw mergeCatalogs path, which does not apply the registry's permission-id regex, so a value containing a newline was emitted verbatim and the generated file failed to compile with TS1002 Unterminated string literal. Caught by the Task 12 implementer actually running tsc over the generated output rather than eyeballing the string. Co-Authored-By: Claude Opus 5 --- docs/plans/2026-08-04-authz-permissions-implementation.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/plans/2026-08-04-authz-permissions-implementation.md b/docs/plans/2026-08-04-authz-permissions-implementation.md index 95677ba5..41d40608 100644 --- a/docs/plans/2026-08-04-authz-permissions-implementation.md +++ b/docs/plans/2026-08-04-authz-permissions-implementation.md @@ -2967,10 +2967,14 @@ import type { AuthzCatalog } from "./types.ts"; function union(values: string[]): string { if (!values.length) return "never"; + // JSON.stringify, not hand-rolled escaping: role names reach this via the + // raw mergeCatalogs path without the registry's id validation, so a value + // may contain a newline, which manual quote/backslash escaping would emit + // as an unterminated string literal. return values .slice() .sort() - .map((value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`) + .map((value) => JSON.stringify(value)) .join(" | "); }