feat(BA-5765): add RBAC-enforced VFolder purge mutation#11165
feat(BA-5765): add RBAC-enforced VFolder purge mutation#11165
Conversation
github-actions
bot
added
size:L
fregataa
force-pushed
the
feature/BA-5765-vfolder-purge-rbac
branch
from
5812862 to
66164d9
Compare
There was a problem hiding this comment.
Pull request overview
Adds an RBAC-enforced purge path for the v2 VFolder REST mutation, shifting authorization to the SingleEntityActionProcessor/RBAC validators and introducing a dedicated service method for the RBAC flow.
Changes:
- Introduce
PurgeVFolderV2RBACAction(+ result) and wire it intoVFolderProcessorsviaSingleEntityActionProcessor. - Add
VFolderService.purge_v2_rbac()and route the v2 adapterpurge()call through the RBAC processor. - Add a component test covering the “regular user denied” scenario and a towncrier fragment.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/component/vfolder_v2/test_vfolder_mutation.py | New component test exercising the v2 purge endpoint via SDK (currently denial-only). |
| src/ai/backend/manager/services/vfolder/services/vfolder.py | Adds purge_v2_rbac() service implementation used by the RBAC processor. |
| src/ai/backend/manager/services/vfolder/processors/vfolder.py | Registers the new RBAC purge action + processor and advertises it in supported_actions(). |
| src/ai/backend/manager/services/vfolder/actions/vfolder_in_project.py | New RBAC purge action/result definitions for single-entity validation. |
| src/ai/backend/manager/api/adapters/vfolder.py | Routes purge() to the new RBAC processor (bulk purge remains legacy). |
| changes/BA-5765.feature.md | Towncrier fragment documenting the new RBAC-enforced purge mutation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
fregataa
force-pushed
the
feature/BA-5765-vfolder-purge-rbac
branch
from
66164d9 to
219f0ac
Compare
|
Is there a reason why |
Add PurgeVFolderV2RBACAction (SingleEntityActionProcessor + RBAC). Adapter purge() routes to RBAC path; bulk_purge() stays on legacy. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fregataa
force-pushed
the
feature/BA-5765-vfolder-purge-rbac
branch
from
219f0ac to
6046cdf
Compare
| me = current_user() | ||
| if me is None: | ||
| raise UnreachableError("User context is not available") | ||
| action = PurgeVFolderV2Action(user_id=me.user_id, vfolder_id=vfolder_id) |
There was a problem hiding this comment.
PurgeVFolderV2Action seems like it might become a dangling reference. If we need to move forward with this, please clean up PurgeVFolderV2Action.
Because batch RBAC validation is not ready yet. I target this job to support purge single VFolder only and I will impl batch purge with RBAC in the future. Check #11186 @jopemachine |
Summary
PurgeVFolderV2RBACAction(SingleEntityActionProcessor+single_entity_rbac_validators).purge_v2_rbac()—get_by_id+delete_vfolders_forever+ storage removal, no manual user/host checks.purge()routes to RBAC processor;bulk_purge()stays on legacy path.Test plan
pants fmt/fix/lint/check— greenTestPurgeVFolderRBAC(regular user 403) via SDKResolves BA-5765