feat(BA-5777): add bulk RBAC filtering infrastructure by fregataa · Pull Request #11191 · lablup/backend.ai

fregataa · 2026-04-20T12:25:26Z

Summary

Add bulk RBAC filtering infrastructure under manager/actions/: BaseBulkAction[T] (generic dataclass with entity_ids: list[str] + abstract typed_entity_ids()), BulkActionValidator returning BulkValidationResult(allowed_entity_ids, denied_entities), and BulkActionProcessor that narrows the action between validators and returns BulkProcessResult(result, validator_decisions) for partial-success responses.
Bulk actions intentionally carry only entity_ids so the processor can reconstruct a narrowed action via type(action)(entity_ids=...) — no factory hook.
Remove the orphan check_and_transit_status_multi path and 10 unused intermediate *BulkAction base classes across services.
Follow-up: wire BulkActionRBACValidator.validate() to PermissionControllerRepository.check_bulk_permission_with_scope_chain() (BA-5776).

Commits:

Add infrastructure.
Rename Batch* → Bulk* to match updated BA-5777 wording.
Address review: BulkValidatorDecision → ValidatorDecision, replace _validator_scope CM with a plain async helper, drop dead name param in test validator.

Test plan

pants fmt / lint / check
pants test tests/unit/manager/actions/test_bulk_processor.py
CI green

Resolves BA-5777

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

This PR introduces infrastructure for per-entity RBAC validation on batch actions (including validator tracing and in-place batch narrowing), and removes an unused/orphaned batch session status-transition path plus several unused intermediate *BatchAction base classes.

Changes:

Refactors batch action plumbing: BaseBatchAction becomes a generic dataclass with mutable entity_ids: list[str] plus typed_entity_ids(), and BatchActionValidator now returns a structured BatchValidationResult and provides a stable name().
Extends BatchActionProcessor to wrap validator execution in an async scope, record per-validator decisions, and filter current_action.entity_ids based on validator outcomes.
Deletes the unused check_and_transit_status_multi batch path and removes now-unused service-level *BatchAction base classes (and associated tests/imports).

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/unit/manager/services/session/test_session_lifecycle_service.py	Removes orphaned tests for the deleted `check_and_transit_status_multi` path.
src/ai/backend/manager/services/session/service.py	Deletes the unused `check_and_transit_status_multi()` service method and its imports.
src/ai/backend/manager/services/session/actions/check_and_transit_status.py	Removes now-unused batch action/result types for check/transit status.
src/ai/backend/manager/services/session/base.py	Removes `SessionBatchAction` base class (batch infra moves to central action layer).
src/ai/backend/manager/services/user_resource_policy/actions/base.py	Removes unused `UserResourcePolicyBatchAction`.
src/ai/backend/manager/services/resource_preset/actions/base.py	Removes unused `ResourcePresetBatchAction`.
src/ai/backend/manager/services/project_resource_policy/actions/base.py	Removes unused `ProjectResourcePolicyBatchAction`.
src/ai/backend/manager/services/keypair_resource_policy/actions/base.py	Removes unused `KeypairResourcePolicyBatchAction`.
src/ai/backend/manager/services/image/actions/base.py	Removes unused `ImageBatchAction`.
src/ai/backend/manager/services/container_registry/actions/base.py	Removes unused `ContainerRegistryBatchAction`.
src/ai/backend/manager/services/artifact_revision/actions/base.py	Removes unused `ArtifactRevisionBatchAction`.
src/ai/backend/manager/services/artifact_registry/actions/base.py	Removes unused `ArtifactBatchRegistryAction`.
src/ai/backend/manager/services/artifact/actions/base.py	Removes unused `ArtifactBatchAction`.
src/ai/backend/manager/actions/validator/batch.py	Adds `DeniedEntity` + `BatchValidationResult`, and updates validator interface to return structured per-entity outcomes.
src/ai/backend/manager/actions/validators/rbac/batch.py	Implements the new batch validator interface and adds a stable validator name (`rbac`).
src/ai/backend/manager/actions/processor/batch.py	Adds validator scoping + decision tracing and filters batch IDs based on validator results; returns `BatchProcessResult`.
src/ai/backend/manager/actions/action/batch.py	Refactors `BaseBatchAction` into a generic dataclass with mutable `entity_ids` and `typed_entity_ids()`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- BaseBatchAction is a generic @DataClass carrying only entity_ids: list[str] plus an abstract typed_entity_ids() returning list[T]; user context and per-operation data are deliberately excluded so the processor can rebuild a narrowed action via type(action)(entity_ids=...) without a factory hook - BatchActionValidator exposes name() + validate() returning BatchValidationResult(allowed_entity_ids, denied_entities: list[DeniedEntity(entity_id, deny_reason)]) - BatchActionProcessor runs each validator inside an _validator_scope async context manager (one place for timing/audit), appends a BatchValidatorDecision(validator_name, results) trace, and returns BatchProcessResult(result, validator_decisions) for partial-success responses - Remove orphan check_and_transit_status_multi path, CheckAndTransitStatus batch action/result and its tests, and 10 unused intermediate batch base classes (Session/Image/ContainerRegistry/*ResourcePolicy/ResourcePreset/ Artifact/ArtifactRevision/ArtifactRegistry) - Add unit tests for BatchActionProcessor covering no-validator pass-through, partial/full deny, multi-validator ordering, and original-action immutability - News fragment 11191.feature.md Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ology BA-5777 description was revised to use "Bulk" throughout. Rename the identifiers introduced in this branch to match: - Files: action/batch.py → action/bulk.py and the mirrors under processor/, validator/, validators/rbac/, plus the test file - Classes & type vars: BaseBatchAction → BaseBulkAction, BaseBatchActionResult → BaseBulkActionResult, BatchActionValidator → BulkActionValidator, BatchActionRBACValidator → BulkActionRBACValidator, BatchActionProcessor → BulkActionProcessor, BatchValidationResult → BulkValidationResult, BatchValidatorDecision → BulkValidatorDecision, BatchProcessResult → BulkProcessResult, TBatchAction/TBatchActionResult → TBulkAction/TBulkActionResult - __init__ exports and changelog fragment updated accordingly Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- Rename BulkValidatorDecision to ValidatorDecision; the dataclass records one validator's verdict, so the Bulk prefix implied a set and conflicted with the surrounding Bulk* processor/result types - Replace the _validator_scope asynccontextmanager with a plain async helper _run_validator; the CM yielded once with no pre/post split, so the bookend ceremony bought nothing over a regular call - Drop the unused name parameter and _name attribute from the test's _AllowSetValidator (name() classmethod hardcodes the identifier) - Note in _run that the service function runs once on the post-filter action so only entities that passed every validator reach it Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

… and improving names Inline _run_validator() into the loop, rename _process_action to _filter_by_validation, and rename current_action to filtered_action. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings April 20, 2026 12:25

github-actions Bot assigned fregataa Apr 20, 2026

github-actions Bot added size:L 100~500 LoC comp:manager Related to Manager component labels Apr 20, 2026

Copilot started reviewing on behalf of fregataa April 20, 2026 12:25 View session

fregataa added a commit that referenced this pull request Apr 20, 2026

changelog: add news fragment for PR #11191

654bb5f

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot AI reviewed Apr 20, 2026

View reviewed changes

Comment thread src/ai/backend/manager/actions/processor/bulk.py Outdated

Comment thread src/ai/backend/manager/actions/processor/batch.py Outdated

fregataa marked this pull request as draft April 20, 2026 12:45

fregataa force-pushed the feature/BA-5777-batch-rbac-filtering-infra branch from 654bb5f to 32a0fa8 Compare April 20, 2026 13:28

github-actions Bot added size:XL 500~ LoC and removed size:L 100~500 LoC labels Apr 20, 2026

fregataa requested a review from a team April 20, 2026 13:37

fregataa marked this pull request as ready for review April 20, 2026 13:37

fregataa added this to the 26.5 milestone Apr 20, 2026

jopemachine reviewed Apr 21, 2026

View reviewed changes

Comment thread src/ai/backend/manager/actions/processor/bulk.py Outdated

jopemachine reviewed Apr 21, 2026

View reviewed changes

Comment thread src/ai/backend/manager/actions/processor/bulk.py

jopemachine reviewed Apr 21, 2026

View reviewed changes

Comment thread src/ai/backend/manager/actions/processor/bulk.py Outdated

jopemachine reviewed Apr 21, 2026

View reviewed changes

Comment thread src/ai/backend/manager/actions/processor/bulk.py Outdated

jopemachine reviewed Apr 21, 2026

View reviewed changes

Comment thread tests/unit/manager/actions/test_bulk_processor.py Outdated

fregataa changed the title ~~feat(BA-5777): add batch RBAC filtering infrastructure~~ feat(BA-5777): add bulk RBAC filtering infrastructure Apr 21, 2026

fregataa force-pushed the feature/BA-5777-batch-rbac-filtering-infra branch from 4d262a7 to 20ac375 Compare April 21, 2026 13:53

fregataa requested review from a team and jopemachine April 21, 2026 13:53

fregataa force-pushed the feature/BA-5777-batch-rbac-filtering-infra branch from 20ac375 to ccacdeb Compare April 22, 2026 08:49

seedspirit reviewed Apr 22, 2026

View reviewed changes

Comment thread src/ai/backend/manager/actions/processor/bulk.py Outdated

seedspirit reviewed Apr 22, 2026

View reviewed changes

Comment thread src/ai/backend/manager/actions/processor/bulk.py Outdated

seedspirit reviewed Apr 22, 2026

View reviewed changes

Comment thread src/ai/backend/manager/actions/processor/bulk.py Outdated

fregataa and others added 3 commits April 22, 2026 19:20

fregataa force-pushed the feature/BA-5777-batch-rbac-filtering-infra branch from ccacdeb to c05370d Compare April 22, 2026 10:31

fregataa requested a review from seedspirit April 22, 2026 10:37

seedspirit approved these changes Apr 22, 2026

View reviewed changes

seedspirit merged commit d133bff into main Apr 22, 2026
30 checks passed

seedspirit deleted the feature/BA-5777-batch-rbac-filtering-infra branch April 22, 2026 11:10

jopemachine pushed a commit that referenced this pull request Apr 24, 2026

feat(BA-5777): add bulk RBAC filtering infrastructure (#11191)

715810a

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(BA-5777): add bulk RBAC filtering infrastructure#11191

feat(BA-5777): add bulk RBAC filtering infrastructure#11191
seedspirit merged 4 commits into
mainfrom
feature/BA-5777-batch-rbac-filtering-infra

fregataa commented Apr 20, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

fregataa commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

fregataa commented Apr 20, 2026 •

edited

Loading