feat: set-only identity + surface-privilege authz (major) - #167
Merged
patrickleet merged 5 commits intoJul 31, 2026
Conversation
Breaking major-release cutover: Session carries x-roles only (no priority-picked primary x-role). GraphQL execute/stream binds to the opened application surface privilege pack (or a membership-checked role surface). Multi-role principals without a named surface fail closed. Anonymous eligible surfaces open with empty identity. e2e-ui: public e2e-ui-public surface, dual-role admin suite uses admin surface for elevated ops, causal grants check any asserted role. Implements [[tasks/graphql-qs-surface-authz-1]]
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Add service test that opens e2e-ui-public with an empty Session and queries chat_messages, plus unauthenticated /public route documenting the bare protocol path. Specs no longer teach Session::role()/x-role as execution. Implements [[tasks/graphql-qs-surface-authz-1]]
- graphql_query_protocol: use role binding for x-roles header; WS connection_init sends x-roles (not x-role) - graphql_oidc_common E1: assert Session::roles() instead of role(), which is None under set-only claim mapping Implements [[tasks/graphql-qs-surface-authz-1]]
Major-release identity is x-roles only; drop migration paths that still accepted or re-injected a singleton primary role. - ROLE_KEY is x-roles; Session::roles/has_role are the identity API - remove causal ensure_causal_grant legacy x-role fallback - schema/metrics privilege fallback uses roles set only - OIDC e2e layer re-injects x-roles (not x-role + default user) - JS DevHeaders + tests send x-roles - keep stripping client x-role as defense-in-depth only Implements [[tasks/graphql-qs-surface-authz-1]]
Unconfigured singleton roles fail closed at execution-authority resolve (same generic surface message), not via legacy primary-role schema lookup. Implements [[tasks/graphql-qs-surface-authz-1]]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements [[tasks/graphql-qs-surface-authz-1]] on top of
tasks--graphql-qs-epic(post multi-role surfaces).Breaking: identity is the
x-rolesset only — no priority-picked primaryx-role. Execution context is the named application surface privilege (or membership-checked role surface). Multi-role requests without a named surface fail closed. Anonymous surfaces open with empty asserted roles when eligible includesanonymous.Changes
x-rolesonly; removerole_priorityprimary pickresolve_execution_authority+ExecutionAuthorityrequest data for compile/livee2e-ui-publicanonymous surface; suitegraphql()auto-selects e2e-ui vs e2e-ui-adminLocal verification
cargo test -p distributed --features graphql,sqlite --lib client_surface_parity(23 ok)cargo test -p distributed --features graphql,sqlite --test graphql_identity(23 ok)cargo test -p e2e-suite --test behavioral(18 ok)Test plan