Skip to content

Commit bae0aa3

Browse files
fregataaclaude
andcommitted
fix(BA-5795): drop redundant host permission check from delete_v2 service
The previous delete_v2_rbac had no host permission check — RBAC at the processor level is sufficient. Also fix the module docstring to not overstate RBAC coverage while PurgeVFolderV2Action is still scope-based. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent ce73789 commit bae0aa3

2 files changed

Lines changed: 2 additions & 16 deletions

File tree

src/ai/backend/manager/services/vfolder/actions/vfolder_v2.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
"""V2 vfolder actions — RBAC-enforced via SingleEntityActionProcessor."""
1+
"""V2 vfolder action definitions."""
22

33
import uuid
44
from dataclasses import dataclass

src/ai/backend/manager/services/vfolder/services/vfolder.py

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,8 @@
1616

1717
from ai.backend.common.bgtask.bgtask import BackgroundTaskManager
1818
from ai.backend.common.clients.valkey_client.valkey_stat.client import ValkeyStatClient
19-
from ai.backend.common.contexts.user import current_user
2019
from ai.backend.common.defs import VFOLDER_GROUP_PERMISSION_MODE
2120
from ai.backend.common.etcd import AsyncEtcd
22-
from ai.backend.common.exception import UnreachableError
2321
from ai.backend.common.types import (
2422
QuotaScopeID,
2523
QuotaScopeType,
@@ -1629,19 +1627,7 @@ async def get_v2(self, action: GetVFolderV2Action) -> GetVFolderV2ActionResult:
16291627

16301628
async def delete_v2(self, action: DeleteVFolderV2Action) -> DeleteVFolderV2ActionResult:
16311629
"""Soft-delete a vfolder by ID. RBAC enforced at processor level."""
1632-
me = current_user()
1633-
if me is None:
1634-
raise UnreachableError("User context is not available")
1635-
vfolder_data = await self._vfolder_repository.get_by_id(action.vfolder_id)
1636-
1637-
# Host permission check — resolved from current user context
1638-
await self._vfolder_repository.ensure_host_permission_allowed_by_user(
1639-
vfolder_data.host,
1640-
permission=VFolderHostPermission.DELETE,
1641-
user_uuid=me.user_id,
1642-
)
1643-
1644-
await self._vfolder_repository.move_vfolders_to_trash([vfolder_data.id])
1630+
await self._vfolder_repository.move_vfolders_to_trash([action.vfolder_id])
16451631
return DeleteVFolderV2ActionResult(vfolder_id=action.vfolder_id)
16461632

16471633
async def purge_v2(self, action: PurgeVFolderV2Action) -> PurgeVFolderV2ActionResult:

0 commit comments

Comments
 (0)