mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-11-13 10:43:28 +08:00
Shruti Nair
756c2a5374
Working on https://github.com/agent-substrate/substrate/issues/1563 Fixes https://github.com/agent-substrate/substrate/issues/1699 Adds OpenFGA authorization checks for `Actor` and `ActorTemplate` CRUD RPCs, enforced when `--experimental-enable-authz` is set. AccessPolicy RPCs are still always enforced. ### Checks | RPC | Check(s) | |---|---| | `CreateActorTemplate` | `can_create_actor_template` on `atespace` | | `Get/DeleteActorTemplate` | `can_get` / `can_delete` on `actor_template` | | `ListActorTemplates` | `can_list_actor_templates` on `atespace` (or `global:root`) | | `CreateActor` | `can_create_actor` on `atespace` + `can_use_template` on template | | `UpdateActor` | `can_update` on `actor` + `can_use_template` on template | | `Get/DeleteActor` | `can_get` / `can_delete` on `actor` | | `ListActors` | `can_list_actors` on `atespace` (or `global:root`) | ### Notes - A rule can produce more than one check, and every check must pass. - The interceptor authenticates the caller before it reads the request. - Missing or invalid identifiers fail closed with `InvalidArgument` and the field path. No check is skipped, so this does not depend on handler validation. - Parent links (`actor`/`actor_template` → `atespace` → `global:root`) are passed as contextual tuples, so creating or deleting a resource writes no tuples. Global owners, stored or bootstrap, reach actors and templates through these links. - `UpdateActor` always checks `can_use_template` on the template. Checking only when the template changes is left for a follow-up. ### Testing - Registry tests for each RPC, plus fail-closed cases for bad identifiers. - Interceptor tests against Postgres-backed OpenFGA, covering editors, viewers, cross-atespace templates, and global and bootstrap owners. - OpenFGA model tests for the new relations.