Feature 09: Permission Enforcement Layer -> dev #104

2026-09-19T08:43:32-04:00

2026-09-19 08:43:32 -04:00

Feature 09: the backend permission gate. Registers the canonical ENTITIES-AND-SERVICES §2 service inventory with voluptuous schemas and services.yaml metadata, a single SERVICE_POLICY registry (complete_quest open; everything else admin-only), a permission_gate wrapper applied to every registered service (reads call.context.user_id, consults admin_allowlist.is_admin, raises Unauthorized; fails closed on no context), audit logging (warning on denial, debug on success), presence writes regenerating child instances, and the full permission test matrix with a registry coverage assertion.

Task PRs: #98 #99 #100 #101 #102 #103. Codex gpt-5.6-terra feature review: one P2 (sort_order=0 truthiness) verified as a false positive — see feature notes.

uv run pytest: 1361 passed. Schema still version 6; no migration.

Feature 09: the backend permission gate. Registers the canonical ENTITIES-AND-SERVICES §2 service inventory with voluptuous schemas and services.yaml metadata, a single SERVICE_POLICY registry (complete_quest open; everything else admin-only), a permission_gate wrapper applied to every registered service (reads call.context.user_id, consults admin_allowlist.is_admin, raises Unauthorized; fails closed on no context), audit logging (warning on denial, debug on success), presence writes regenerating child instances, and the full permission test matrix with a registry coverage assertion. Task PRs: #98 #99 #100 #101 #102 #103. Codex gpt-5.6-terra feature review: one P2 (sort_order=0 truthiness) verified as a false positive — see feature notes. `uv run pytest`: 1361 passed. Schema still version 6; no migration.

orchestrator-agent added 13 commits 2026-09-19 08:43:33 -04:00

Register canonical NestQuest HA services with schemas 2d30f0ce77

Domain-global handlers for the ENTITIES-AND-SERVICES inventory plus
regenerate. No permission decorator yet.

Regenerate child instances after presence service writes b1c42f10d0

Presence pattern and override handlers now call regenerate_for_child.
Definition edit/activate pass HA-local today and configured horizon.

Register canonical NestQuest HA services with schemas a2e9bdffee

Register canonical NestQuest HA services with schemas (#98)

Add admin-only versus open service policy registry 4281b9d01c

One mapping in service_policy.py: complete_quest is open, every other
registered nestquest service is admin_only.

Add admin-only versus open service policy registry dd7ea10936

Gate every NestQuest service behind the admin permission check 37d7b7e6c3

permission_gate wraps all registered services at registration time:
admin-only policy reads call.context.user_id against admin_allowlist
is_admin (fail closed on no context); complete_quest stays open.

Gate every NestQuest service behind the admin permission check 2a0e568940

Cover fail-closed no-context behavior across admin-only services d0f49b44b5

Parametrised test denies no-context calls on every admin-only service;
complete_quest proceeds with no user; scheduled internals stay direct
function calls.

Cover fail-closed no-context behavior across admin-only services eb4de7b565

Test the permission gate's audit logging b5058a3bed

Warning on denial and debug on success carry the service, the caller
user id (or none), and a UTC stamp; nothing beyond the user id leaks.

Test the permission gate audit logging cf67e9bed9

Add the permission test matrix across every registered service c1efd39ce3

Admin succeeds on all ten admin-only services; a non-admin and a
no-context call are refused on each; complete_quest stays open; a
kiosk-style id is refused on uncomplete_quest and regenerate; the
registry coverage assertion fails the suite on any gap.

Add the permission test matrix across every registered service fc81b4b813

orchestrator-agent merged commit 3ac1d32e1b into dev

2026-09-19 08:43:37 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Maniacs_Mansion/NestQuest#104