Skip to content

Commit 3a140ea

Browse files
fregataaclaude
fregataa
and
claude
committed
fix(BA-6059): remove deprecated 'global' scope_type RBAC data
Permission rows with scope_type='global' break Query.adminPermissions because RBACElementType has no GLOBAL member, raising RBACTypeConversionError in _permission_data_to_node. Remove the 11 global-scoped fixture entries from both example-roles.json files and add an idempotent alembic migration that deletes leftover global-scope rows from permissions and association_scopes_entities. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent 1fdb5a1 commit 3a140ea

3 files changed

Lines changed: 40 additions & 176 deletions

File tree

‎fixtures/manager/example-roles.json‎

Lines changed: 0 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -246,94 +246,6 @@
246246
}
247247
],
248248
"permissions": [
249-
{
250-
"id": "c90a7514-68f2-40c0-88f9-159dce6856cd",
251-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
252-
"scope_type": "global",
253-
"scope_id": "",
254-
"entity_type": "user",
255-
"operation": "grant:all"
256-
},
257-
{
258-
"id": "6dc1c67d-bc50-4778-936e-0630dfb83a8a",
259-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
260-
"scope_type": "global",
261-
"scope_id": "",
262-
"entity_type": "user",
263-
"operation": "read"
264-
},
265-
{
266-
"id": "1d3ed696-904f-4af2-a326-5e35ecc71695",
267-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
268-
"scope_type": "global",
269-
"scope_id": "",
270-
"entity_type": "user",
271-
"operation": "hard-delete"
272-
},
273-
{
274-
"id": "c1109646-9d08-4ccb-acc6-9438830c2fff",
275-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
276-
"scope_type": "global",
277-
"scope_id": "",
278-
"entity_type": "user",
279-
"operation": "grant:read"
280-
},
281-
{
282-
"id": "6540be54-c760-4fee-bc5a-ec72ef50ea49",
283-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
284-
"scope_type": "global",
285-
"scope_id": "",
286-
"entity_type": "user",
287-
"operation": "grant:hard-delete"
288-
},
289-
{
290-
"id": "b057323f-9f91-4d3d-9bdd-70883672f8b0",
291-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
292-
"scope_type": "global",
293-
"scope_id": "",
294-
"entity_type": "user",
295-
"operation": "grant:soft-delete"
296-
},
297-
{
298-
"id": "9639fa62-3751-48e1-8454-86319a945832",
299-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
300-
"scope_type": "global",
301-
"scope_id": "",
302-
"entity_type": "user",
303-
"operation": "update"
304-
},
305-
{
306-
"id": "4f5c7bf1-45dc-4ac5-8866-0c472147af09",
307-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
308-
"scope_type": "global",
309-
"scope_id": "",
310-
"entity_type": "user",
311-
"operation": "soft-delete"
312-
},
313-
{
314-
"id": "7b0b5bfe-aae9-4887-9fa7-a78ba9243883",
315-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
316-
"scope_type": "global",
317-
"scope_id": "",
318-
"entity_type": "user",
319-
"operation": "grant:update"
320-
},
321-
{
322-
"id": "831b4e1c-427a-4ea9-b882-7753d1daa721",
323-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
324-
"scope_type": "global",
325-
"scope_id": "",
326-
"entity_type": "user",
327-
"operation": "create"
328-
},
329-
{
330-
"id": "5e983bd3-77cb-4271-9629-3b311b9f43d9",
331-
"role_id": "02d084f3-49e1-4fcb-bc62-e9d06637e60d",
332-
"scope_type": "global",
333-
"scope_id": "",
334-
"entity_type": "user",
335-
"operation": "read"
336-
},
337249
{
338250
"id": "064b0ba0-93bd-4f69-a5e9-80db199586a7",
339251
"role_id": "31f74f6d-04f7-418b-b375-ab0c39fa3058",

‎src/ai/backend/install/fixtures/example-roles.json‎

Lines changed: 0 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -246,94 +246,6 @@
246246
}
247247
],
248248
"permissions": [
249-
{
250-
"id": "c90a7514-68f2-40c0-88f9-159dce6856cd",
251-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
252-
"scope_type": "global",
253-
"scope_id": "",
254-
"entity_type": "user",
255-
"operation": "grant:all"
256-
},
257-
{
258-
"id": "6dc1c67d-bc50-4778-936e-0630dfb83a8a",
259-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
260-
"scope_type": "global",
261-
"scope_id": "",
262-
"entity_type": "user",
263-
"operation": "read"
264-
},
265-
{
266-
"id": "1d3ed696-904f-4af2-a326-5e35ecc71695",
267-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
268-
"scope_type": "global",
269-
"scope_id": "",
270-
"entity_type": "user",
271-
"operation": "hard-delete"
272-
},
273-
{
274-
"id": "c1109646-9d08-4ccb-acc6-9438830c2fff",
275-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
276-
"scope_type": "global",
277-
"scope_id": "",
278-
"entity_type": "user",
279-
"operation": "grant:read"
280-
},
281-
{
282-
"id": "6540be54-c760-4fee-bc5a-ec72ef50ea49",
283-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
284-
"scope_type": "global",
285-
"scope_id": "",
286-
"entity_type": "user",
287-
"operation": "grant:hard-delete"
288-
},
289-
{
290-
"id": "b057323f-9f91-4d3d-9bdd-70883672f8b0",
291-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
292-
"scope_type": "global",
293-
"scope_id": "",
294-
"entity_type": "user",
295-
"operation": "grant:soft-delete"
296-
},
297-
{
298-
"id": "9639fa62-3751-48e1-8454-86319a945832",
299-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
300-
"scope_type": "global",
301-
"scope_id": "",
302-
"entity_type": "user",
303-
"operation": "update"
304-
},
305-
{
306-
"id": "4f5c7bf1-45dc-4ac5-8866-0c472147af09",
307-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
308-
"scope_type": "global",
309-
"scope_id": "",
310-
"entity_type": "user",
311-
"operation": "soft-delete"
312-
},
313-
{
314-
"id": "7b0b5bfe-aae9-4887-9fa7-a78ba9243883",
315-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
316-
"scope_type": "global",
317-
"scope_id": "",
318-
"entity_type": "user",
319-
"operation": "grant:update"
320-
},
321-
{
322-
"id": "831b4e1c-427a-4ea9-b882-7753d1daa721",
323-
"role_id": "942d7613-27f1-49c5-944a-5c79045346a1",
324-
"scope_type": "global",
325-
"scope_id": "",
326-
"entity_type": "user",
327-
"operation": "create"
328-
},
329-
{
330-
"id": "5e983bd3-77cb-4271-9629-3b311b9f43d9",
331-
"role_id": "02d084f3-49e1-4fcb-bc62-e9d06637e60d",
332-
"scope_type": "global",
333-
"scope_id": "",
334-
"entity_type": "user",
335-
"operation": "read"
336-
},
337249
{
338250
"id": "064b0ba0-93bd-4f69-a5e9-80db199586a7",
339251
"role_id": "31f74f6d-04f7-418b-b375-ab0c39fa3058",

‎src/ai/backend/manager/models/alembic/versions/ba42cb865efe_remove_global_scope_rbac_rows.py‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
"""remove global-scoped RBAC rows from permissions and association_scopes_entities
2+
3+
The ``global`` scope_type is deprecated and has no corresponding
4+
``RBACElementType``. Existing rows leak through the GQL ``adminPermissions``
5+
adapter and raise ``RBACTypeConversionError`` (see BA-6059).
6+
7+
A previous migration (``5a4e677aea42``) cleaned ``permissions`` once but rows
8+
re-appeared via fixture loads. ``d7879c511ea1`` only partially cleaned
9+
``association_scopes_entities``. This migration removes any remaining
10+
``scope_type = 'global'`` rows from both tables and is safe to re-apply.
11+
12+
Revision ID: ba42cb865efe
13+
Revises: b2d4f6e8c1a3
14+
Create Date: 2026-05-15
15+
16+
"""
17+
18+
# Part of: 26.5.0
19+
20+
import sqlalchemy as sa
21+
from alembic import op
22+
23+
# revision identifiers, used by Alembic.
24+
revision = "ba42cb865efe"
25+
down_revision = "b2d4f6e8c1a3"
26+
branch_labels = None
27+
depends_on = None
28+
29+
30+
def upgrade() -> None:
31+
conn = op.get_bind()
32+
conn.execute(sa.text("DELETE FROM permissions WHERE scope_type = 'global'"))
33+
conn.execute(sa.text("DELETE FROM association_scopes_entities WHERE scope_type = 'global'"))
34+
35+
36+
def downgrade() -> None:
37+
# Global scope is deprecated and has no corresponding RBACElementType.
38+
# The deletion is not reversible because the original scope_id and entity
39+
# mappings are not preserved.
40+
pass

0 commit comments

Comments
 (0)