orchestrator-agent
fc81b4b813
Add the permission test matrix across every registered service
2026-09-19 08:40:25 -04:00
orchestrator-agent
c1efd39ce3
Add the permission test matrix across every registered service
...
Admin succeeds on all ten admin-only services; a non-admin and a
no-context call are refused on each; complete_quest stays open; a
kiosk-style id is refused on uncomplete_quest and regenerate; the
registry coverage assertion fails the suite on any gap.
2026-09-19 08:40:20 -04:00
orchestrator-agent
cf67e9bed9
Test the permission gate audit logging
2026-09-19 08:39:08 -04:00
orchestrator-agent
b5058a3bed
Test the permission gate's audit logging
...
Warning on denial and debug on success carry the service, the caller
user id (or none), and a UTC stamp; nothing beyond the user id leaks.
2026-09-19 08:39:02 -04:00
orchestrator-agent
eb4de7b565
Cover fail-closed no-context behavior across admin-only services
2026-09-19 08:38:29 -04:00
orchestrator-agent
d0f49b44b5
Cover fail-closed no-context behavior across admin-only services
...
Parametrised test denies no-context calls on every admin-only service;
complete_quest proceeds with no user; scheduled internals stay direct
function calls.
2026-09-19 08:38:24 -04:00
orchestrator-agent
2a0e568940
Gate every NestQuest service behind the admin permission check
2026-09-19 08:37:47 -04:00
orchestrator-agent
37d7b7e6c3
Gate every NestQuest service behind the admin permission check
...
permission_gate wraps all registered services at registration time:
admin-only policy reads call.context.user_id against admin_allowlist
is_admin (fail closed on no context); complete_quest stays open.
2026-09-19 08:36:14 -04:00
orchestrator-agent
dd7ea10936
Add admin-only versus open service policy registry
2026-09-18 16:07:56 -04:00
orchestrator-agent
4281b9d01c
Add admin-only versus open service policy registry
...
One mapping in service_policy.py: complete_quest is open, every other
registered nestquest service is admin_only.
2026-09-18 16:05:12 -04:00
orchestrator-agent
a2e9bdffee
Register canonical NestQuest HA services with schemas
...
Register canonical NestQuest HA services with schemas (#98 )
2026-09-18 16:03:50 -04:00
orchestrator-agent
b1c42f10d0
Regenerate child instances after presence service writes
...
Presence pattern and override handlers now call regenerate_for_child.
Definition edit/activate pass HA-local today and configured horizon.
2026-09-18 16:03:42 -04:00
orchestrator-agent
2d30f0ce77
Register canonical NestQuest HA services with schemas
...
Domain-global handlers for the ENTITIES-AND-SERVICES inventory plus
regenerate. No permission decorator yet.
2026-09-18 15:59:02 -04:00
orchestrator-agent