From 64f5d37c34a10ca5cc490e2b96b03145b8d327fd Mon Sep 17 00:00:00 2001 From: Manish Kumar Date: Fri, 7 Aug 2026 21:34:48 -0500 Subject: [PATCH] docs: fix test count, document permission-aware auth + tenancy gate, add structure - Testing: README said "48 tests passing, 93% coverage". Live run today: 90 tests, 95% coverage. - New "Permission-aware authorization" section: app/core/permissions.py's ACTION_PERMISSION_MAP is the receiving end of omnibioai-api-gateway's own SERVICE_PERMISSION_MAP (documented in that repo's README last turn) -- a real, currently-active gate checking the requester's `permissions` claim against omnibioai-auth's registry strings (workflow.execute, model.use, dataset.read). "Core Features" only described generic RBAC/ABAC before; this gate wasn't mentioned anywhere. - New "Org-tenancy scoping" section + Roadmap correction: the Roadmap said "Org-level multi-tenancy | Planned v0.5", reading as if nothing exists yet. app/core/tenancy.py already implements an opt-in resource_org_id scoping gate, fully tested -- it's accurate that no real caller activates it yet (the gate is a no-op until a caller supplies resource_org_id, and none does today), but that's a narrower gap than "planned" implied. Split the roadmap line into what's implemented (the gate itself) vs. what's still open (enforced-by-default multi-tenancy). - New "Repository Structure" section -- this README had none, despite meaningful internal layering (core/{rbac,abac,engine,rules,tenancy, permissions}.py, services/{cache,policy_service}.py, models/). Co-Authored-By: Claude Sonnet 5 --- README.md | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 56 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 884d690..54a9cb9 100644 --- a/README.md +++ b/README.md @@ -67,6 +67,31 @@ It evaluates: * Bioinformatics dataset protection rules * Model registry immutability rules +### 🔑 Permission-aware authorization + +A second, additive gate alongside role-name/action-string RBAC +(`app/core/rbac.py`): `app/core/permissions.py`'s `ACTION_PERMISSION_MAP` +checks the requester's `permissions` claim (forwarded by +`omnibioai-api-gateway`'s `PolicyMiddleware` on every `/policy/evaluate` +call) against the same permission-registry strings `omnibioai-auth` +reserves (`workflow.execute`, `model.use`, `dataset.read`, etc.) — +this is the receiving end of the gateway's own +`SERVICE_PERMISSION_MAP` (see +[omnibioai-api-gateway's README](../omnibioai-api-gateway#authentication-pipeline)). +Deliberately opt-in: a caller with `permissions=[]` falls back to the +pre-existing role-based check, so nothing changes for traffic that +predates permission-awareness. + +### 🏢 Org-tenancy scoping + +`app/core/tenancy.py` adds an opt-in tenancy gate: if a request names +which organization owns the resource being acted on +(`context["resource_org_id"]`), the requester's own `org_id` must match +it. This service has no database of its own to look resource ownership +up in, so it can only enforce this when a caller explicitly supplies it +— a no-op for every caller today (no real caller populates +`resource_org_id` yet). See [Roadmap](#roadmap) below. + --- ## 🚀 API Overview @@ -144,6 +169,32 @@ curl http://localhost:8001/health --- +## Repository Structure + +```text +app/ +├── main.py +├── api/ +│ ├── routes_policy.py # POST /policy/evaluate — the only route +│ └── deps.py +├── core/ +│ ├── engine.py # Orchestrates RBAC → ABAC → permissions → tenancy → rules +│ ├── rbac.py # Role-name/action-string check +│ ├── abac.py # Attribute-based checks (GPU, HPC node, dataset sensitivity) +│ ├── permissions.py # ACTION_PERMISSION_MAP — see "Permission-aware authorization" above +│ ├── tenancy.py # Opt-in org_id scoping gate — see "Org-tenancy scoping" above +│ └── rules.py # Domain-specific policy rules +├── services/ +│ ├── policy_service.py # Service-layer orchestration +│ └── cache.py # Redis-backed decision cache +├── models/ +│ ├── request.py, policy.py, decision.py # Pydantic request/response models +└── db/ # Present but unused today — this service has no + # database of its own (see "Org-tenancy scoping") +``` + +--- + ## 🧠 Policy Evaluation Flow 1. **RBAC check** @@ -181,8 +232,8 @@ This service is used by: cd ~/Desktop/machine/omnibioai-policy-engine pytest tests/ -v --cov=. -# 48 tests passing -# 93% coverage +# 90 tests passing +# 95% coverage # Covers: RBAC, ABAC, rule engine, cache, policy service, routes ``` @@ -225,9 +276,11 @@ pytest tests/ -v --cov=. | Redis caching for policy decisions | ✓ Implemented | | RBAC/ABAC evaluation | ✓ Stable | | Custom rule engine | ✓ Stable | +| Permission-aware authorization (`app/core/permissions.py`) | ✓ Implemented — see [Permission-aware authorization](#permission-aware-authorization) below | +| Org-tenancy scoping gate (`app/core/tenancy.py`) | ✓ Implemented, opt-in — activates only once a caller supplies `context["resource_org_id"]`; no real caller does yet | | OPA (Open Policy Agent) backend | Planned | | Policy versioning system | Planned | -| Org-level multi-tenancy | Planned v0.5 | +| Org-level multi-tenancy enforced by default | Planned v0.5 | ---