Skip to content

feat(enterprise): enforce rbac owner guard#68

Closed
Gracker wants to merge 1 commit intofeature/enterprise-multi-tenant-api-key-managementfrom
feature/enterprise-multi-tenant-rbac-owner-guard
Closed

feat(enterprise): enforce rbac owner guard#68
Gracker wants to merge 1 commit intofeature/enterprise-multi-tenant-api-key-managementfrom
feature/enterprise-multi-tenant-rbac-owner-guard

Conversation

@Gracker
Copy link
Copy Markdown
Owner

@Gracker Gracker commented May 8, 2026

Summary

  • add a shared RBAC helper for the §8.2 role/scopes matrix
  • enforce trace read/write/delete, report read/delete, and agent analyze agent:run checks on RequestContext routes
  • update trace/report owner guard behavior so same-workspace access follows RBAC while cross-tenant/workspace stays hidden
  • add route and unit tests for viewer, analyst, workspace admin, API-key scopes, and cross-tenant guard behavior
  • mark README §0.2.4 complete

Scope note

  • This applies the RBAC matrix to the core RequestContext-protected trace/report/analyze paths in this stack.
  • Resource-oriented /api/workspaces/:workspaceId/* wrappers remain §0.2.6.

Verification

  • cd backend && npx jest src/services/__tests__/enterpriseSchema.test.ts src/services/__tests__/enterpriseOidcClient.test.ts src/services/__tests__/rbac.test.ts src/routes/__tests__/enterpriseAuthRoutes.test.ts src/routes/__tests__/enterpriseApiKeyRoutes.test.ts src/routes/__tests__/agentRoutesRbac.test.ts src/middleware/__tests__/auth.test.ts src/routes/__tests__/requestContextRouteCoverage.test.ts src/routes/__tests__/ownerGuardRoutes.test.ts src/services/__tests__/sessionPersistenceService.test.ts --runInBand
  • cd backend && npm run typecheck
  • cd backend && npm run test:scene-trace-regression
  • npm run verify:pr

mr-torto pushed a commit to mr-torto/SmartPerfetto that referenced this pull request May 8, 2026
, Gracker#33, Gracker#49, Gracker#68, Gracker#69, Gracker#72, Gracker#78, #132)

StartupAnrMethodGraphContract bundles the startup / ANR / method-trace
attribution graph. Four facets, all optional:
- StartupPhaseRow[] with ART verifier / JIT / class loading / Compose
  recomposition / Startup library initializers (Spark Gracker#32, Gracker#68, Gracker#69,
  #132)
- AnrAttribution[] joining traces.txt thread samples to method-trace
  evidence (Spark Gracker#33, Gracker#49)
- MethodTraceNode[] for Matrix / BTrace / RheaTrace / KOOM / bytecode
  imports (Spark Gracker#72, Gracker#78)
- Reused JankDecisionNode (Plan 10) for the decision tree shape

StartupPhase uses string union so future Perfetto stdlib startup phases
do not require an enum bump.

Plan: docs/superpowers/spark/plans/17-startup-anr-memory-graphs.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
mr-torto pushed a commit to mr-torto/SmartPerfetto that referenced this pull request May 8, 2026
buildStartupAnrMethodGraph fuses startup phase rows, ANR attribution and
method-trace nodes into one StartupAnrMethodGraphContract. Coverage is
computed per spark dimension based on input shape:
- Phases with art/JIT/class-loading timings flip Spark #132
- Phases with non-zero recompositionCount flip Spark Gracker#68
- Phases with initializersFired flip Spark Gracker#69
- ANR attribution flips Spark Gracker#33; thread samples flip Spark Gracker#49
- Method-trace nodes with source matrix/btrace/rheatrace/koom flip
  Spark Gracker#72; bytecode source flips Spark Gracker#78

The pruneMethodTraceChildren helper drops dangling child ids from the
node graph so the contract is always renderable even when upstream
importers emit incomplete data.

Tests: 5 cases covering ART promotion, recomposition promotion, dangling
children pruning, source-based promotion, and unsupported.

Plan: docs/superpowers/spark/plans/17-startup-anr-memory-graphs.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@Gracker
Copy link
Copy Markdown
Owner Author

Gracker commented May 9, 2026

已通过 commit 67856ec (merge) + 023a84a (frontend rebuild) 合入 main,关闭此 PR。

@Gracker Gracker closed this May 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant