Repository navigation
ogar-rbac: per-class default field mask in the grant source (HubSPO D-IAM-3) - #358
Conversation
GrantSource::default_field_mask_of(concept) is the column projection a role gets on a class when the source has no mask for that role there, so sensitive fields stay hidden unless a role's own mask names them (HubSPO D-IAM-3). The authority writes it into the binding through RbacBinding::with_class_field_defaults (lance-graph #1556), and OgarRbac's own ClassRbac::field_mask now reads the source the same way: role mask, then class default, then every field. Before this, the direct path ignored field_mask_of altogether and always answered every field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Warning Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 960f05f536
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
It is the contract's WideFieldMask::from(FieldMask::FULL), the value this impl inherited before, which covers positions 0..64; the comment said every field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg
2 participants
What
GrantSource::default_field_mask_of(concept) -> Option<WideFieldMask>: for a class, the field mask a role gets when the source has no mask for that role there. Fields left out (sensitive properties) stay hidden unless a role's own mask names them. The default implementation isNone, so every existing source keeps the class open.The mask lands in two places:
OgarRbac::bindpasses the per-class defaults toRbacBinding::with_class_field_defaults(lance-graph #1556, merged).OgarRbac's ownClassRbac::field_masknow reads the source in the same order as the binding: the role's mask, then the class default, then every field. Before this PR the direct path never calledfield_mask_of, soauthorize_useralways returned every field.Why
HubSPO-rs D-IAM-3 needs field-level permissions. This POC sets them as policy data through RBAC and the classid; no reasoning is coded into the mask lookup.
Effect on existing users
MedCare's source implements
field_mask_ofbut calls onlybind, which is unchanged for it. No source implementsdefault_field_mask_ofyet.Tests
the_class_default_closes_roles_without_a_mask. It checks the binding and the direct path, and that a source without mask data still answers every field.the_binding_carries_the_sources_field_masksis unchanged.Disable runs:
field_mask→ the new test fails.Local gates:
fmt --check,clippy -D warnings, andogar-rbactests (22 passing).🤖 Generated with Claude Code
https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg
Generated by Claude Code