fix: add wildcard explicitly to the Resource type

[mcstepp]

What does this PR do?

Fixes a build error on dashboard when referencing analytics permission with wildcard. TypeScript types for Resources didn't properly support the * wildcard at the type level, even though the runtime validation does.

Fixes #4344

Type of change

• [x] Bug fix (non-breaking change which fixes an issue)
• [x] Chore (refactoring code, technical debt, workflow improvements)
• [ ] Enhancement (small improvements)
• [ ] New feature (non-breaking change which adds functionality)
• [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
• [ ] This change requires a documentation update

How should this be tested?

1. Build Test

cd apps/dashboard
pnpm build

If the build succeeds without TypeScript errors about "api.*.read_analytics", the fix works.

2. Dev Server Test

cd apps/dashboard
pnpm dev

Navigate to the root keys permissions page at: /[workspaceSlug]/settings/root-keys/[keyId]/permissions If the page loads without errors, the types are working.

3. TypeScript Check npx tsc --noEmit --project apps/dashboard/tsconfig.json Should complete with no errors related to read_analytics or permissions.

Checklist

Required

• [x] Filled out the "How to test" section in this PR
• [x] Read Contributing Guide
• [x] Self-reviewed my own code
• [x] Commented on my code in hard-to-understand areas
• [x] Ran pnpm build
• [x] Ran pnpm fmt
• [ ] Ran make fmt on /go directory
• [x] Checked for warnings, there are none
• [x] Removed all console.logs
• [x] Merged the latest changes from main onto my branch with git pull origin main
• [x] My changes don't cause any responsiveness issues

Appreciated

• [ ] If a UI change was made: Added a screen recording or screenshots to this PR
• [ ] Updated the Unkey Docs if changes were necessary

[linear[bot]]

ENG-2220 Fix RBAC Resource types to support '*' wildcard for analytics

[changeset-bot[bot]]

⚠️ No Changeset found

Latest commit: 5dc16289bcb85ebeb7db23978b285a4df3df5356

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel[bot]]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
dashboard	Ready	Preview	Comment	Nov 14, 2025 8:21pm
engineering	Ready	Preview	Comment	Nov 14, 2025 8:21pm

[coderabbitai[bot]]

📝 Walkthrough

Walkthrough

The Resources type in the RBAC permissions module is updated to support wildcard * in resource IDs for four scoped resource types: api, ratelimit, rbac, and identity. Each resource key is widened to accept either a specific ID or *, aligning TypeScript type definitions with existing runtime validation that already supports wildcards.

Changes

Cohort / File(s)	Summary
Type expansion for wildcard resource IDs packages/rbac/src/permissions.ts	Updated Resources type to allow * wildcard in resource ID portion for api, ratelimit, rbac, and identity resource types; enables keys like api.*.read_analytics to pass type checking

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

• Homogeneous changes following a consistent pattern applied to four related resource types
• Type-system only modification with no runtime logic or behavioral changes
• Straightforward type widening with low complexity
• Verify that all relevant resource types were updated and TypeScript template literal syntax is correct

Pre-merge checks and finishing touches

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely describes the main change: adding wildcard support to the Resource type.
Description check	✅ Passed	The PR description is comprehensive, providing clear context about the bug, issue reference, testing instructions, and mostly complete checklist items.
Linked Issues check	✅ Passed	The PR fully addresses #4344 by implementing the suggested fix to allow '*' wildcard in Resource key types for all scoped resources (api, ratelimit, rbac, identity).
Out of Scope Changes check	✅ Passed	All changes are in-scope: only the Resources type in permissions.ts was modified to add wildcard support as required by issue #4344.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

• [ ] 📝 Generate docstrings

🧪 Generate unit tests (beta)

• [ ] Create PR with unit tests
• [ ] Post copyable unit tests in a comment
• [ ] Commit unit tests in branch ENG-2220-fix-rbac-resource-types

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 15beb6d7743e4d92c84627bf9c0a4fc37175fcf7 and 5dc16289bcb85ebeb7db23978b285a4df3df5356.

📒 Files selected for processing (1)

• packages/rbac/src/permissions.ts (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)

• GitHub Check: Test Dashboard / Test Dashboard
• GitHub Check: Test API / API Test Local
• GitHub Check: Test Packages / Test
• GitHub Check: Build / Build
• GitHub Check: Analyze (javascript-typescript)

🔇 Additional comments (1)

packages/rbac/src/permissions.ts (1)

83-94: LGTM! Type definitions now correctly align with runtime validation.

The addition of | "*" to each resource ID type properly reflects the wildcard support already implemented in the buildIdSchema function (lines 14-16), where "*" is explicitly checked and accepted. This type widening resolves the TypeScript compilation error for permissions like "api.*.read_analytics" without altering any runtime behavior.

All four scoped resources (api, ratelimit, rbac, identity) are updated consistently with the same pattern.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions[bot]]

Thank you for following the naming conventions for pull request titles! 🙏

[chronark]

closing this cause it should be fixed already, if not we can reevaluate