Repository navigation
feat: project-defined roles with node-scoped grants - #1303
Merged
Merged
Conversation
Work in progress, not yet ready for review. roles.toml at the project root defines project roles. Each grant's node selectors resolve per snapshot when the location publishes. Effective grants are the approved (selector, permission) pairs that the new definition still contains: removals apply at once, and additions wait for an administrator's approval. Runs need the permission on every node they write, view.sql is checked per node, and authorization takes the union across a person's roles. Validated so far: the native role tests (13, on SQLite and PostgreSQL), the full orchestration native suite (104), the installed test_project_roles.py, Fensu and the hygiene scan. Not yet run: make check-ci. The full publication suite has failures that are still being attributed.
make check-ci now passes on this branch: clippy with -D warnings, ruff and Fensu.
When a publication changes a custom role's effective grants, either by removing pairs or by changing selector coverage, the change is appended to that snapshot's change feed as role:<key>, as CHI-907 section 13 requires. Validated: the native role tests (13 on SQLite and PostgreSQL), the full orchestration native suite (104) and make check-ci.
trigger.toggle and sensor.reset_cursor are now authorized on every node the trigger's current job or group writes, all or nothing, as job.run is. A role covering only some of those nodes can no longer pause or reset the trigger. The catalog, statistics and run listings span the whole location, so they now need view coverage of every node in the current publication. Partial coverage is denied and names the missing nodes; results are never filtered. Validated: the native role tests (15, on SQLite and PostgreSQL), deliberate breaks of both fixes, the full orchestration native suite (106), 13 installed publication tests and make check-ci.
A member keeps an assignment to a role that a later snapshot no longer defines. The assignment must grant nothing, on nodes or location-wide, and the removal must appear in the change feed. Covered on SQLite and PostgreSQL.
Project roles now take effect on publish; the activation and approval workflow, its tables and its docs are gone. The merge also brings the group concurrency fix and the follow-up simplification batch.
# Conflicts: # crates/sqlbuild-orchestration/src/authorization/main/authorize_person.rs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Projects need reviewed custom roles whose grants follow the nodes they select, checked on every node an operation touches. Stacked on #1282; draft.
Changes
roles.tomlat the project root:[roles.X]with[[roles.X.grants]]ofnodesselectors andpermissions.sqb location publishresolves each selector with the job selection grammar into the snapshotrolesdocument. A grant matching nothing warns and grants nothing.role:<key>.viewon every node;view.sqlis per node. A denial lists up to 20 missing nodes.cli/server.Verification
roles.tomlcompilation.test_project_roles.py: publish warning, per-node SQL denial, growth, and a rewrite waiting for approval.project_roles.toml;custom_role_approval.jsonupdated.make check-ciand the hygiene scan pass.