feat(authorization): hierarchical PDP, start-login helper, and PATs - #103
feat(authorization): hierarchical PDP, start-login helper, and PATs#103seonghobae wants to merge 3 commits into
Conversation
Issue software-unit ACL, menu ABAC/RBAC, SSO combination scopes, and org-path inheritance from Orgmetra assignment snapshots without copying employment truth. Add a Keyverse-owned start-login helper and hashed programmable application tokens. ADR-0008 remains the RP PEP boundary; ADR-0009 stays reserved for the unmerged LineageWeave claim profile. Tracks #2. Implements #102. Co-authored-by: Seongho Bae <[email protected]>
|
Warning Review limit reached
Next review available in: 41 minutes Limit details: You’ve used all 1 included review currently available under your plan. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (36)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Cover omitted assignment snapshots, failed menu grant PUTs, and policy errors on token verify so statement and branch coverage stay at 100% on the authorization slice. Co-authored-by: Seongho Bae <[email protected]>
Hosted account-unification-tests failed at uv sync --locked because uv.lock still recorded coverage 7.15.2 and setuptools 83.0.0 after pyproject.toml moved to 7.15.4 and 84.0.0. Refresh the lock metadata only so CI can install the already-reviewed pins. Co-authored-by: Seongho Bae <[email protected]>
|
@coderabbitai review |
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head44fb43428eab0075b9e5ee114a5ade56bb18eec2. -
Head SHA:
44fb43428eab0075b9e5ee114a5ade56bb18eec2 -
Workflow run: 32095234736
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (12 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (12 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs (21 files)"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs (21 files)"]
R2 --> V2["docs review"]
Evidence --> S3["Test (4 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (4 files)"]
R3 --> V3["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage evidence job did not run or did not publish coverage evidence. Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (12 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (12 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs (21 files)"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs (21 files)"]
R2 --> V2["docs review"]
Evidence --> S3["Test (4 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (4 files)"]
R3 --> V3["targeted test run"]
|
2 participants
Summary
Buyer-facing Keyverse authorization slice on
main. It makes these six capabilities real as issuer-side contracts plus tests and docs, without restacking on open PRs #83, #100, or #101:kc_idp_hint, no metadata fetch)Tracks #2. Implements #102. Does not close #2 (cross-system SSO epic still includes live federation acceptance and remaining P5 work).
Boundary decisions
keyverse_subject,org_path, optionalassignment_record_id) and does not copy the Orgmetra tree.role/org/workspaceprofile on PR Add account-derived LineageWeave RP profile #100. Hierarchical names aregroup_company,legal_entity,business_unit,team,person, andorg_path.ADRs
Head
Current head:
44fb43428eab0075b9e5ee114a5ade56bb18eec2Hosted CI
Exact-head product CI on this SHA is green (run 32092028160):
account-unification-testsjob 95575987666 — successrealm-config-validatesjob 95575987605 — successcompose-config-validatesjob 95575987627 — successPredecessor
363b26cfailed inaccount-unification-testsjob 95575377973 (run 32091826557) at Install locked dependencies.uv sync --lockedrefuseduv.lockbecause it still recorded coverage 7.15.2 and setuptools 83.0.0 afterpyproject.tomlmoved to 7.15.4 and 84.0.0. This head only resynchronizes the lock to those already-reviewed pins.Operator / app next action
See
docs/authorization-onboarding.md:POST /federation/identity-providers:start-login, then adds PKCE locally and redirects tostart_login_url.POST /application-tokens, stored in the application secret manager, and presented only toPOST /application-tokens:verify.Evidence still required
This PR does not claim production federation, login, or downstream PEP acceptance. Those remain controlled runtime evidence after IdP apply, confidential secret placement, and RP token validation.
Safety
No password authenticator, no unverified-email merge, no portable-realm application clients, no RP-environment secrets, no restack of #83 / #100 / #101. Draft remains draft.