control-plane-api: update_l2_reporting gates ops admin via Snapshot - #3436
Open
bbartman wants to merge 2 commits into
Open
control-plane-api: update_l2_reporting gates ops admin via Snapshot#3436bbartman wants to merge 2 commits into
bbartman wants to merge 2 commits into
Conversation
bbartman
force-pushed
the
bmb/strangle-2-update-l2-reporting
branch
from
August 28, 2026 17:48
2a5d039 to
26973b3
Compare
bbartman
force-pushed
the
bmb/strangle-2-update-l2-reporting
branch
from
August 31, 2026 14:05
26973b3 to
3064cfd
Compare
Swap the endpoint's internal.user_roles() SQL gate for the same evaluate_names_authorization policy over the pinned Snapshot that create-data-plane now uses, evaluated through Envelope::authorization_outcome. Denials gain the standard retry protocol, and the ancestor-subject grant walk applies (see the pinned gate tests in the parent module). This removes the last caller of the exact user_roles query text, so `cargo sqlx prepare` drops its orphaned offline-cache entry. The two live_specs metadata files also regenerated with updated column nullability against current migrations. Denial-path endpoint tests mirror create-data-plane's: with the gate's policy shared, per-endpoint wiring is what remains to regress.
bbartman
force-pushed
the
bmb/strangle-2-update-l2-reporting
branch
from
September 1, 2026 12:02
3064cfd to
15825d2
Compare
Regenerating the query cache reverts two entries this branch had no business touching: the connector_status nullability flag in the live-specs status queries. Both columns are aliased with sqlx's `?` force-nullable override, so the flag never reached the generated types -- it was pure metadata drift from a prepare run against a differently migrated database, and it would fail `ci:sqlx-check`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 2 of the 3-PR stack strangling the last reachable Rust call sites of
internal.user_roles(). Stacked on #3435.Plan
With #3435 having migrated
/admin/create-data-planeand established the shared gate (evaluate_names_authorization(snapshot, claims, Admin, ["ops/"])throughEnvelope::authorization_outcome), this PR applies the identical swap to/admin/update-l2-reporting— the second of the three remaining call sites. The third (the storage-mappings directive) follows in the final PR, which threads the agent'ssnapshot_watchintoDirectiveHandler.This change
update_l2_reportingdrops itsinternal.user_roles()SQL gate for the shared Snapshot policy. Denials gain the standard authorization-retry protocol (early Snapshot refresh + 307 retry on possible staleness), and the ancestor-subject grant walk applies — the deliberate semantic change pinned bytest_evaluate_ops_admin_ancestor_subject_chainin control-plane-api: create_data_plane gates ops admin via Snapshot #3435.select role_prefix from internal.user_roles($1, 'admin') where role_prefix = 'ops/', socargo sqlx preparedrops its orphaned offline-cache entry. Twolive_specsquery-metadata files also regenerated with updated column nullability against current migrations (deliberate: full-prepare was chosen over hand-deleting the orphan; CI'ssqlx-checkarbitrates).Tests
Denial-path endpoint tests mirror create-data-plane's (no bearer → 401, non-ops-admin → terminal 403 with the standard message). With the gate's policy shared and unit-tested in #3435, per-endpoint wiring is the remaining regression surface — which is exactly what these pin. Allowed cases (including the ancestor chain) stay in the shared gate's unit tests; no success-path endpoint test, since an authorized request proceeds into the L2 template publication, out of scope for authorization tests.