weichen/Agent-System-Backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add EXT-8b resource-level authorization contract #178

Merged
weichen merged 1 commits from feature/ext8-resource-authz-v2 into main 2026-10-12 11:45:35 +00:00
Conversation 0 Commits 1 Files Changed 7
+184 -4
weichen commented 2026-10-12 11:44:16 +00:00
Owner
Copy Link
Copy Source

Why

方案 r1 U9 首切片（Documents proposals/2026-10-12-rdm-function-implementation-plan.md）：EXT-8 V1 只有 owner×project 布尔回调，无法表达资源粒度判定（R7/U9：域内自有命中、共享读取、列表/检索逐项过滤）。

Evidence

  • 红测：ResourceAuthzQuery/ResourceAuthorizerV2/RegisterResourceAuthorizerV2 未定义（编译红）；
  • 绿测：pkg/extension surface 棘轮同步（SurfaceVersion → 2.10.0-experimental）；internal/app 槽位测试全覆盖（V2 六要素咨询 / V1 兼容回落 / 受信字段缺失＝拒 / V2 error fail-closed / 首注册者生效 / compiledRegistry 拒绝声明式注册）；go test ./... 全绿

Impact

  • 公开面：ResourceAuthzQuery{Actor,Action,ResourceType,ResourceID,Owner,ProjectID}（执行端受信构造，不采信请求自报归属）+ ResourceAuthorizerV2 + Registry.RegisterResourceAuthorizerV2
  • internal/app：projectAuthz 增 V2 槽与 AuthorizeResource（V2 优先、V1 兼容回落）；pluginRegistry 注册填充；compiledRegistry fail-closed
  • 读路径 server 消费接线（authorizeSharedProject 5 处升级为资源级）与 Dev pin/RDM 升 pins 留待后续切片

Refs

方案 r1 U9/KTD2；surface.txt 棘轮

## Why 方案 r1 U9 首切片（Documents proposals/2026-10-12-rdm-function-implementation-plan.md）：EXT-8 V1 只有 owner×project 布尔回调，无法表达资源粒度判定（R7/U9：域内自有命中、共享读取、列表/检索逐项过滤）。 ## Evidence - 红测：ResourceAuthzQuery/ResourceAuthorizerV2/RegisterResourceAuthorizerV2 未定义（编译红）； - 绿测：pkg/extension surface 棘轮同步（SurfaceVersion → 2.10.0-experimental）；internal/app 槽位测试全覆盖（V2 六要素咨询 / V1 兼容回落 / 受信字段缺失＝拒 / V2 error fail-closed / 首注册者生效 / compiledRegistry 拒绝声明式注册）；`go test ./...` 全绿 ## Impact - 公开面：ResourceAuthzQuery{Actor,Action,ResourceType,ResourceID,Owner,ProjectID}（执行端受信构造，不采信请求自报归属）+ ResourceAuthorizerV2 + Registry.RegisterResourceAuthorizerV2 - internal/app：projectAuthz 增 V2 槽与 AuthorizeResource（V2 优先、V1 兼容回落）；pluginRegistry 注册填充；compiledRegistry fail-closed - 读路径 server 消费接线（authorizeSharedProject 5 处升级为资源级）与 Dev pin/RDM 升 pins 留待后续切片 ## Refs 方案 r1 U9/KTD2；surface.txt 棘轮
weichen added 1 commit 2026-10-12 11:44:16 +00:00
Add EXT-8b resource-level authorization contract
ci / vet-and-test (pull_request) Successful in 45s
Details
0270b40197 
Why: 方案 r1 U9 首切片——V1（owner×project 布尔）无法表达资源粒度判定，读面（下载/列表/检索/模型上下文）需要执行端按资源咨询下游。
Evidence: 红：resource_authz_v2_test.go 编译红（ResourceAuthzQuery/V2 未定义）；绿：pkg/extension surface 棘轮（2.10.0）+ internal/app 槽位测试（V2 咨询/V1 回落/字段缺失拒/error fail-closed/首注册者生效/compiled 拒绝）；go test ./... 全绿（收据 /tmp/be-v2-test.txt）。
Impact: 公开面新增 ResourceAuthzQuery/ResourceAuthorizerV2/Registry.RegisterResourceAuthorizerV2；projectAuthz 增 V2 槽（AuthorizeResource：V2 优先、V1 兼容回落、受信字段缺失＝拒）；compiledRegistry fail-closed 拒绝声明式注册；读路径消费接线（server 5 处 authorizeSharedProject 升级）留待下一切片。
Refs: 方案 r1 U9/KTD2；RDM EXT-8 现有消费者（hostcaps/projectAuthz）
weichen merged commit bbe977351d into main 2026-10-12 11:45:35 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
weichen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: weichen/Agent-System-Backend#178