refactor(BA-6943): authorize scheduling-history scoped searches via RBAC#12974
Draft
jopemachine wants to merge 9 commits into
Draft
refactor(BA-6943): authorize scheduling-history scoped searches via RBAC#12974jopemachine wants to merge 9 commits into
jopemachine wants to merge 9 commits into
Conversation
jopemachine
force-pushed
the
feat/BA-6943-scoped-search-rbac
branch
from
July 20, 2026 07:17
36bc484 to
300fe27
Compare
The session, deployment and route scoped searches carried a SearchScope built straight from request input and exposed no RBAC element, so validators.rbac never ran: the repository turned the scope into a WHERE clause and existence_checks only confirmed the entity existed, not that the caller could read it. The routes papered over this by requiring super-admin, which made the scoped variants useless to the users who own the entities. Each scoped search now defines a SearchableActionTarget that maps to both an RBAC element and a search scope, the actions extend BaseBulkAction, and the processors run through BulkActionProcessor with validators.rbac.bulk -- the ActionValidators argument the package already accepted but never used. The repository takes a sequence of scopes so multiple authorized targets can be matched. A caller asking for a scope they do not hold gets PermissionDeniedError rather than an empty page. With authorization enforced on the action path, the three scoped routes drop to auth_required; the unscoped admin searches stay superadmin_required. Handlers lose the admin_ prefix, which no longer describes them. Kernel is converted separately in BA-6891. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jopemachine
force-pushed
the
feat/BA-6943-scoped-search-rbac
branch
from
July 20, 2026 07:22
300fe27 to
18d537a
Compare
Co-authored-by: octodog <mu001@lablup.com>
…outes Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: octodog <mu001@lablup.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Convert the session, deployment and route scoped searches to BaseScopeAction, matching the kernel conversion in BA-6891 and the other scoped searches in the codebase: the history is the entity being read and the owning entity is the scope containing it. Each action exposes target_element(), and the processors run through ScopeActionProcessor with validators.rbac.scope -- the ActionValidators argument the package already accepted but never used. Add the three history element types to RBACElementType and its public DTO (kept in sync by test_rbac_element_type_sync), ScopeType.ROUTING so the route scope round-trips, and a migration mirroring every existing READ grant on a session / model_deployment / routing onto its history entity, following add_admin_page_read_permissions. With authorization enforced on the action path, the three scoped routes drop to auth_required. The unscoped admin searches are untouched and stay superadmin_required. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
github-actions
Bot
added
comp:common
Co-authored-by: octodog <mu001@lablup.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #12971 (BA-6943)
Summary
SearchableActionTargetmapping to both an RBAC element (SESSION/MODEL_DEPLOYMENT/ROUTING) and a search scope; the actions extendBaseBulkActionand the processors run throughBulkActionProcessorwithvalidators.rbac.bulk.SearchScopebuilt straight from request input and exposed no RBAC element, sovalidators.rbacnever ran — the repository turned the scope into aWHEREclause andexistence_checksonly confirmed the entity existed, not that the caller could read it. The routes papered over this by requiring super-admin, which made the scoped variants useless to the users who actually own the entities.auth_required. With authorization enforced on the action path, a user can read the scheduling history of a session/deployment/route they hold, and getsPermissionDeniedErrorfor one they do not — not a silently empty page. The unscoped admin searches staysuperadmin_required.admin_prefix, which no longer describes them.SchedulingHistoryProcessors.__init__already acceptedActionValidatorswithout using it; that was the wiring point. The repository now takesSequence[SearchScope]so multiple authorized targets can be matched.Independent of the BA-6889..BA-6893 kernel stack — branched from
main, touches only the three pre-existing entities.search_kernel_scoped_historyis deliberately untouched here (converted in #12869); doing it on both branches would conflict.Test plan
pants checkclean (5251 source files)pants lintclean oversrc/ai/backend/::andtests/unit/manager/::element_refs()BulkActionRBACValidatorshort-circuits for super admins, so the unscoped admin paths are unaffected🤖 Generated with Claude Code
📚 Documentation preview 📚: https://sorna--12974.org.readthedocs.build/en/12974/
📚 Documentation preview 📚: https://sorna-ko--12974.org.readthedocs.build/ko/12974/