control-plane: authorize create-data-plane and update-l2-reporting via the request Snapshot (6/7) - #3350
Open
bbartman wants to merge 1 commit into
Open
Conversation
…a the request Snapshot create-data-plane and update-l2-reporting replace their raw ops/-admin SQL pre-check (internal.user_roles) with the standard Envelope idiom (evaluate_names_authorization + authorization_outcome), extracted as server::authorize_ops_admin. The request's pinned Snapshot now serves both the pre-check and the ops publication: one request, one authorization view. A denial under a Snapshot which predates the request is now a 307 AuthZRetry rather than an immediate 403; the flow-plane-link unit gains curl -L so a redirect can't read as success.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Part 6 of the snapshot-authorization stack (follows the stack-5 spec-fetch-policy PR). Decomposed from #3300.
create-data-planeandupdate-l2-reportingreplace their rawops/-admin SQL pre-check (select ... from internal.user_roles($1, 'admin') where role_prefix = 'ops/') with the standard Envelope idiom —evaluate_names_authorization+authorization_outcome— extracted asserver::authorize_ops_admin. The request's pinned Snapshot now serves both the pre-check and the subsequent ops publication: one request, one authorization view.Behavior change: a denial under a Snapshot which predates the request is now a 307
AuthZRetryrather than an immediate 403. Correspondingly, theflow-plane-linksystemd unit gainscurl -Lso a redirect can't read as success.The now-unused
.sqlxmetadata for theuser_rolesops-admin query is removed.Verified locally:
cargo nextest run -p control-plane-api -p agent— 296/296 passing at this branch tip, including new denial tests for both endpoints.Workflow steps:
Operators calling
create-data-plane/update-l2-reportingwhile theirops/admin grant is newer than the server's authorization snapshot now receive a retryable 307 instead of a 403; clients following redirects (asflowctland the updatedflow-plane-linkunit do) converge without intervention.Documentation links affected:
None.
Notes for reviewers:
authorize_ops_adminincrates/control-plane-api/src/server/mod.rs— it is small, and everything else hangs off it.update_l2_reporting.rsandcreate_data_plane.rspin the new behavior. Confirm the retry-on-stale outcome is what you want for these admin endpoints.create_data_plane.rsdiff is the largest in the PR but is mostly mechanical: threading the Envelope through, plus new tests. Thelocal/systemd/flow-plane-link@.servicechange (curl -L) is required by the 307, not optional.