opschain admin authz convert-report

Included from Basic tier

Classifies every stored authorisation rule path for the regex-to-glob conversion. Legacy rule paths are ^-anchored regular expressions; the forward grammar is globs. The report sorts each rule into one of three classes:

• literal — no regex metacharacters: the path carries over unchanged.
• glob-convertible — a mechanical rewrite exists, and the report prints the suggested glob: .* as a whole segment becomes **, .* at the very end of the path becomes a trailing *, and [^/]* / [^/]+ become * within a segment. The conversion is deliberately conservative.
• regex (manual rewrite) — anything else containing a metacharacter.

Non-literal rules are also checked against Go's RE2 engine: a rule that does not compile is flagged as not evaluable by the compat engine's regex fallback (engine_compatible: false with the compile error in the structured output), so it stops working before it is rewritten.

The command reads the database directly — no server or login is needed.

Flags

Flag	Meaning
--store <dsn>	Required. A postgres:// (or postgresql://) DSN reads the adopted upstream authorisation tables; any other value is treated as a SQLite database file path. A Phase 0 local-mode SQLite store holds no authorisation tables, and the report says exactly that instead of reporting zero rules.

Global -o, --output json|yaml switches the report to the machine document (rule rows plus literal_count, glob_convertible_count, regex_count, and no_authorisation_tables when set).

Exit codes

• 0 — report produced (including the no-tables case).
• 1 — the store could not be opened or read.
• 2 — usage (--store missing).

Examples

opschain admin authz convert-report --store postgres://opschain@db/opschain
3 rules: 1 literal, 1 glob-convertible, 1 regex needing manual rewrite
  [literal] ^/projects/demo
  [glob-convertible] ^/projects/[^/]*/environments -> /projects/*/environments (env access)
  [regex (manual rewrite)] ^/projects/(a|b)/.*

Against a local-mode SQLite store:

opschain admin authz convert-report --store ~/.opschain/opschain.db
This store holds no authorisation tables (local-mode store); there are no rules to convert.

See also

• opschain docs cli/admin-authz-review-export — the entitlement report over the same adopted tables.
• opschain docs cli/admin-authz-rules — rewriting the rules the report classifies.