feat(BA-5380): seed RBAC permissions for vfolder:data and session:app by fregataa · Pull Request #11457 · lablup/backend.ai

fregataa · 2026-05-01T11:33:26Z

Summary

Forward-only Alembic migrations that backfill vfolder:data (CRUD) and session:app (read) permissions for owner/admin roles in domain/project/user scopes.
Migrates existing vfolder_permissions invitations to per-entity vfolder:data grants using the entity-as-scope pattern (permissions(scope_type='vfolder', scope_id=vfolder_id, ...)); mount perms map ro→{read}, rw→{read,update}, wd→{read,update,hard-delete} (no soft-delete on data).
Sub-entity rows in association_scopes_entities are intentionally omitted: the resolver walks parent vfolder/session edges via permission_entity_type, and the existing uq_scope_id_entity_id constraint would conflict with parent edges anyway. Downgrade is a no-op to protect operator-managed grants.

Test plan

pants fmt fix lint check on the two new migration files
Local DB upgrade: 102 rows seeded (vfolder:data 82 + session:app 20) on a 33-role / 1-invitation dataset
Verify entity-as-scope tuples (vfolder, model_deployment scopes) excluded from broad seed — invitee gets exactly mount-perm-mapped ops, no over-grant
Downgrade is no-op (data preserved); re-upgrade is idempotent (no duplicate rows via ON CONFLICT DO NOTHING)
CI green

Copilot

Pull request overview

Adds forward-only Alembic data migrations to backfill RBAC permissions rows for two sub-entity permission domains (vfolder:data and a session app-related entity type), including mapping legacy vfolder invitation mount permissions into per-vfolder entity-as-scope grants.

Changes:

Seed vfolder:data owner operations for non-member roles across domain/project/user scopes.
Backfill vfolder_permissions invitation records into permissions(scope_type='vfolder', scope_id=<vfolder_id>, entity_type='vfolder:data', ...) using a mount-permission→operation mapping.
Seed a read-only session app-related entity-type permission for non-member roles across domain/project/user scopes.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`src/ai/backend/manager/models/alembic/versions/6e5a7a62a687_migrate_vfolder_data_to_rbac.py`	Seeds `vfolder:data` permissions for org scopes and migrates legacy vfolder invitations to per-vfolder RBAC grants.
`src/ai/backend/manager/models/alembic/versions/3632aad9d5d9_migrate_session_app_to_rbac.py`	Seeds a read-only session app-related entity-type permission for org scopes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

seedspirit · 2026-05-04T07:33:34Z

+
+# Constants
+MEMBER_ROLE_PATTERN = "%member"
+ENTITY_TYPE = "session:app"


The entity type enum is defined as SESSION_APP_SERVICE = "session:app_service". Does it matter if there is a mismatch?

Also, vfolder:data does not appear to exist in the EntityType (or anywhere in the codebase).

they are added in #11456

Forward-only Alembic migrations that backfill owner/admin permissions for the new sub-entity types in domain/project/user scopes, and migrate vfolder_permissions invitations to per-entity `vfolder:data` grants. Sub-entity scope-entity edges are intentionally omitted — the resolver walks parent edges via `permission_entity_type`. Downgrade is a no-op. Resolves BA-5380 Resolves BA-5383

- Remove unused `REF_RELATION_TYPE` constant from the vfolder:data migration. - Clarify the 11457 news fragment.

The earlier broad scope-wide seed granted vfolder:data and session:app operations on domain/project/user scopes for non-member roles. The RBAC resolver's scope-chain walker traverses user → project → domain via the membership edges in association_scopes_entities, so a project- or domain-scoped grant on these owner-only sub-entities would let project admins (or domain admins) reach user-owned vfolders and sessions inside their scope — violating the owner-only intent. Replace with per-entity (entity-as-scope) grants: - user-owned vfolders → owner's system role only - project-owned vfolders → project's non-member roles only - vfolder_permissions invitations → invitee's system role with mount-permission-mapped ops (already entity-as-scope) - live sessions → creator's system role + project non-member roles - dead sessions (TERMINATING/TERMINATED/CANCELLED/ERROR) excluded These rows match the resolver's self-scope branch only; the walker never visits them, so no upward leak.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Repoint the vfolder:data data migration onto the current main head to resolve divergent alembic heads, and replace the silent skip for unknown vfolder_permissions.permission values with a warning log so operators can investigate stray rows. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Rename `session:app` to `session:app_service` in the data migration seed and changelog to match `EntityType.SESSION_APP_SERVICE` defined in `common/data/permission/types.py`. Without this, seeded permission rows would never resolve at runtime. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings May 1, 2026 11:33

github-actions Bot assigned fregataa May 1, 2026

github-actions Bot added size:L 100~500 LoC comp:manager Related to Manager component require:db-migration Automatically set when alembic migrations are added or updated labels May 1, 2026

Copilot started reviewing on behalf of fregataa May 1, 2026 11:34 View session

Copilot AI reviewed May 1, 2026

View reviewed changes

Comment thread src/ai/backend/manager/models/alembic/versions/3632aad9d5d9_migrate_session_app_to_rbac.py Outdated

Comment thread src/ai/backend/manager/models/alembic/versions/6e5a7a62a687_migrate_vfolder_data_to_rbac.py Outdated

fregataa added a commit that referenced this pull request May 1, 2026

changelog: add news fragment for PR #11457

44352c8

fregataa requested a review from a team May 1, 2026 12:26

fregataa marked this pull request as draft May 1, 2026 13:06

fregataa marked this pull request as ready for review May 2, 2026 17:36

fregataa added a commit that referenced this pull request May 2, 2026

changelog: add news fragment for PR #11457

57f6d43

fregataa force-pushed the feat/BA-5380-BA-5383-rbac-data-migration branch from 1126c18 to ba36f51 Compare May 2, 2026 17:40

jopemachine reviewed May 4, 2026

View reviewed changes

Comment thread src/ai/backend/manager/models/alembic/versions/6e5a7a62a687_migrate_vfolder_data_to_rbac.py Outdated

seedspirit previously approved these changes May 4, 2026

View reviewed changes

seedspirit self-requested a review May 4, 2026 07:32

seedspirit reviewed May 4, 2026

View reviewed changes

seedspirit self-requested a review May 4, 2026 07:34

fregataa added a commit that referenced this pull request May 6, 2026

changelog: add news fragment for PR #11457

e4d44da

fregataa dismissed seedspirit’s stale review via 70eeb09 May 6, 2026 05:56

fregataa force-pushed the feat/BA-5380-BA-5383-rbac-data-migration branch from ba36f51 to 70eeb09 Compare May 6, 2026 05:56

fregataa added a commit that referenced this pull request May 6, 2026

changelog: add news fragment for PR #11457

9efe27d

fregataa force-pushed the feat/BA-5380-BA-5383-rbac-data-migration branch from 70eeb09 to d55509f Compare May 6, 2026 14:50

fregataa requested a review from a team May 6, 2026 15:04

fregataa and others added 6 commits May 7, 2026 11:14

changelog: add news fragment for PR #11457

32c6cf4

chore(BA-5380): drop unused constant and refine changelog

eb83dcb

- Remove unused `REF_RELATION_TYPE` constant from the vfolder:data migration. - Clarify the 11457 news fragment.

fix(BA-5380): correct down_revision for vfolder:data data migration

c79176d

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

update alembic revision path

5d31085

fregataa and others added 2 commits May 7, 2026 11:14

fregataa force-pushed the feat/BA-5380-BA-5383-rbac-data-migration branch from d55509f to ab38733 Compare May 7, 2026 02:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(BA-5380): seed RBAC permissions for vfolder:data and session:app#11457

feat(BA-5380): seed RBAC permissions for vfolder:data and session:app#11457
fregataa wants to merge 8 commits intomainfrom
feat/BA-5380-BA-5383-rbac-data-migration

fregataa commented May 1, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

seedspirit May 4, 2026 •

edited

Loading

Uh oh!

jopemachine May 4, 2026

Uh oh!

fregataa May 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

fregataa commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

seedspirit May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jopemachine May 4, 2026

Choose a reason for hiding this comment

Uh oh!

fregataa May 6, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

fregataa commented May 1, 2026 •

edited

Loading

seedspirit May 4, 2026 •

edited

Loading