trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-11-03 08:17:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(policy): reuse provider snapshot for merge validation

Browse Source 
Derive provider layers, credential scopes, and binding records from the same loaded provider snapshot to eliminate cross-read inconsistency.

Signed-off-by: Akber Raza <akberr@nvidia.com>
This commit is contained in:
Akber Raza
2026-09-14 18:16:05 -07:00
committed by Drew Newberry
parent 387d0b792f
commit 38a07466d0
1 changed files with 6 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/openshell-server/src/grpc/policy.rs
+6 -12
View File
@@ -6790,17 +6790,17 @@ async fn sandbox_policy_merge_validation_data_with_catalog(
) -> Result<SandboxPolicyMergeValidationData, Status> {
let global_settings = load_global_settings(state.store.as_ref()).await?;
let composition_enabled = provider_policy_composition_enabled_in(&global_settings)?;
let ProviderPolicyContext {
layers,
credentialed_scopes,
endpointless_provider_names,
} = provider_policy_context_with_catalog(
let records = super::provider::load_provider_environment_records(
state.store.as_ref(),
catalog,
workspace,
provider_names,
)
.await?;
let ProviderPolicyContext {
layers,
credentialed_scopes,
endpointless_provider_names,
} = provider_policy_context_from_records(catalog, &records);
let provider_layers = if composition_enabled {
layers
} else {
@@ -6811,12 +6811,6 @@ async fn sandbox_policy_merge_validation_data_with_catalog(
provider_layer_count = provider_layers.len(),
"Composed provider policy and credential context for merge validation"
);
let records = super::provider::load_provider_environment_records(
state.store.as_ref(),
workspace,
provider_names,
)
.await?;
Ok(SandboxPolicyMergeValidationData {
provider_layers,
catalog: catalog.clone(),