Repository navigation
feat: update tiled policy to support layered node - #345
Open
ZohebShaikh wants to merge 4 commits into
Open
ZohebShaikh wants to merge 4 commits into
ZohebShaikh wants to merge 4 commits into
Conversation
|
could you provide a description for this ticket please? |
Collaborator
Author
|
Added as requested |
fajinyuan
reviewed
Oct 16, 2026
| # description: | | ||
| # Turns a proposal label into the plain number it is stored under, | ||
| # so "cm1234" becomes 1234. | ||
| bare_proposal(p) := to_number(trim_left(lower(p), "abcdefghijklmnopqrstuvwxyz")) |
There was a problem hiding this comment.
This accepts any alphabetic prefix, not just cm. Can we tighten this so malformed proposal labels fail closed?
Comment on lines
109
to
+119
| } | ||
|
|
||
| # service account check | ||
| user_session := format_int(_session, 10) if { | ||
| # Session level, for a service account tied to the beamline. | ||
| user_session := session_tag(input.beamline, p, input.visit) if { | ||
| input.visit | ||
| not token.claims.fedid | ||
| input.beamline == token.claims.beamline | ||
| input.beamline == session.beamline_for(input.proposal, input.visit) | ||
| _session in data.diamond.data.beamlines[input.beamline].sessions | ||
| p := bare_proposal(input.proposal) | ||
| input.beamline == session.beamline_for(p, input.visit) | ||
| _session(p) in data.diamond.data.beamlines[input.beamline].sessions | ||
| } |
There was a problem hiding this comment.
Can we confirm a token with both claims never falls back to the service-account branch if the named-user check fails?
Comment on lines
+190
to
+194
|
|
||
| user_sessions contains beamline_tag(s.beamline) if { | ||
| not "*" in session.user_sessions | ||
| some id in session.user_sessions | ||
| s := data.diamond.data.sessions[id] |
There was a problem hiding this comment.
Please confirm session.user_sessions is always complete and correct here; it now directly controls which Tiled nodes are visible.
user_sessions returned three tags for every session a caller could reach, so a beamline admin's answer covered every session on the beamline (about 106k tags and ~4.7 s for a non-admin who can reach everything). Return grants at the level they are held instead, and stamp each node with its ancestors' grant tags so one grant matches the whole subtree: - beamline admins and service accounts get the beamline tag - proposal members get the proposal tag - session members get the session tag plus "visible:" tags for the containers above a grant, so they can be listed without granting what else is under them. user_session now returns the node's full tag list, own tag first. The beamline claim in user_beamlines now only counts for service accounts: a token that also carries a fedid was granted the whole beamline through it, in tiled, session and ulims. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Calls tiled/user_session, tiled/user_sessions and tiled/scopes with the inputs dls_tiled.policy's build_input sends, on a small i22 tree the writer builds through user_session, and checks exactly which nodes each kind of caller sees: service account, beamline admin, proposal member, session member, super admin, nobody. One test shows that passing the containers with grant tags instead of visible: tags would leak the whole beamline. The header explains how tiled matches tags and why nodes carry their ancestors' grants plus visible: tags on containers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CI used the latest OPA and Regal, so a new release could change results without any change here. Pin both, and the devcontainer's OPA, and make the policy pass them: string interpolation where Regal now prefers it, admin_test checks beamline_admin_for_subject by key (OPA 1.21's type checker rejects `in` on it), and blueapi.rego drops an unused import. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR changes the Tiled authorization policy so access can be granted at three levels: beamline → proposal → session. Before, it only worked with flat session IDs.
What changes
1. Hierarchical access tags replace bare session IDs
Nodes used to be tagged with a session ID such as
"11". They now get a path-style tag that names every level above them:beamline:i03beamline:i03,proposal:1beamline:i03,proposal:1,session:1-1Each tag names its parents, so Tiled can check access at any level of the tree with one set-membership test.
2.
user_session(create-node) can now create all three levelsTiled's
init_nodedoesn't pass a path or parent, so the policy works out the level from which input fields are present:beamlineonlybeamline.user_beamlinesbeamline+proposalbeamline+proposal+visitinput.proposalis now a label such as"cm1234"and is reduced to1234bybare_proposal. Before, it was a plain integer.3.
user_sessions(list/filter) emits tags for all levelsFor each session the caller can reach, it returns the session's tag plus its beamline and proposal tags, so the parent nodes stay visible in listings. Admins still get
"*". The old local logic (direct, beamline-based and proposal-based sessions, plus service accounts) is removed. It now usessession.user_sessionsfrom the shared session policy.4. Service-account branches are stricter
The session-level and proposal-level service-account rules now require
not token.claims.fedid. A token with bothfedidandbeamlineclaims is judged by the named user's own permissions. Before, a matchingbeamlineclaim could let such a token through. There's a new test for this.5. Housekeeping
# METADATAdoc blocks to each rule.adminis replaced bybeamlineandproposal.withclauses intiled_test.regoandulims_test.rego, with no change in behaviour."11"won't match the new tags inuser_sessions, so they'll need a migration or re-tagging.proposalas a label string instead of an int, and the Tiled side (dls.py) needs to change to match.🤖 Generated with Claude Code