mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-08-15 01:08:53 +00:00
92c8f2f03b
* feat(authz): add built-in RBAC provider and provider factory (Phase 1A-2, #4063) Phase 1A-2: RBAC provider + provider factory. No runtime behavior change. New authz/rbac.py — RbacAuthorizationProvider: - allow: '*' / True / list / [] / missing → deny-wins semantics - deny always overrides all allow forms - resource name explicit mapping (tool→tools, model→models, etc.) - unknown/missing role raises ValueError (never silent allow) - config compiled to immutable frozensets at construction - filter_resources preserves order, no mutation, consistent with authorize - sync == async decisions New authz/runtime.py — resolve_authorization_provider: - disabled → None (no import attempted) - enabled + no provider → ValueError - invalid class path / construction failure → ValueError with path - isinstance Protocol check post-construction - no caching, no fail_closed/default_role injection 48 tests (37 RBAC + 11 factory). No config schema change, no config_version bump. Per RFC #4063 Phase 1A-2. Layer 1/Layer 2 wiring deferred to Phase 1B. * fix(authz): reject unknown RBAC provider config Fail fast on misspelled top-level RBAC settings, cover factory error propagation, and record Phase 1B policy and audit caveats. * fix(authz): reject unreachable resource aliases Fail fast when RBAC config uses reserved request-side aliases, preserve same-name and custom resources, and add regression coverage for every mapped alias. * fix(authz): validate RBAC request identifiers
21 lines
771 B
Python
21 lines
771 B
Python
"""Pluggable fine-grained authorization (resource-level RBAC and beyond)."""
|
|
|
|
from deerflow.authz.adapter import GuardrailAuthorizationAdapter
|
|
from deerflow.authz.principal import build_principal_from_context, normalize_authz_attributes
|
|
from deerflow.authz.provider import AuthorizationProvider, AuthzDecision, AuthzReason, AuthzRequest, Principal
|
|
from deerflow.authz.rbac import RbacAuthorizationProvider
|
|
from deerflow.authz.runtime import resolve_authorization_provider
|
|
|
|
__all__ = [
|
|
"AuthzDecision",
|
|
"AuthzReason",
|
|
"AuthzRequest",
|
|
"AuthorizationProvider",
|
|
"GuardrailAuthorizationAdapter",
|
|
"Principal",
|
|
"RbacAuthorizationProvider",
|
|
"build_principal_from_context",
|
|
"normalize_authz_attributes",
|
|
"resolve_authorization_provider",
|
|
]
|