feat(BA-6191): add ScopeCreatorSpec and ScopePurgerSpec to Ops layer#11843
Closed
fregataa wants to merge 4 commits into
Closed
feat(BA-6191): add ScopeCreatorSpec and ScopePurgerSpec to Ops layer#11843fregataa wants to merge 4 commits into
fregataa wants to merge 4 commits into
Conversation
github-actions
Bot
added
size:L
fregataa
added a commit
that referenced
this pull request
May 28, 2026
fregataa
force-pushed
the
feat/BA-6191-scope-creator-spec
branch
2 times, most recently
from
a9cdfd8 to
7576fba
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces composite “scope lifecycle” specs and a dedicated RBAC write-ops surface to orchestrate multi-table RBAC scope provisioning/teardown in a single transaction, rather than forcing each repository spec to span multiple tables.
Changes:
- Add
ScopeCreatorSpec/ScopePurgerSpec(and result wrappers) as composite coordinators for scope create/purge flows. - Implement
RBACWriterOpswithcreate_scope()andpurge_scope()orchestration (role-preset → roles/permissions + scope/entity associations; and inverse teardown). - Expose
DBOpsProvider.rbac_write_ops()and re-export new scope APIs fromrepositories.base.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
src/ai/backend/manager/repositories/ops/provider.py |
Adds RBACWriterOps orchestration and a new rbac_write_ops() context manager on DBOpsProvider. |
src/ai/backend/manager/repositories/base/scope_creator.py |
Introduces ScopeContext and ScopeCreatorSpec/ScopeCreatorResult composites for scope provisioning. |
src/ai/backend/manager/repositories/base/scope_purger.py |
Introduces ScopePurgerSpec/ScopePurgerResult composites for scope teardown. |
src/ai/backend/manager/repositories/base/__init__.py |
Re-exports the new scope-creator/purger APIs from the base repository package. |
changes/11843.feature.md |
Towncrier fragment describing the new RBAC scope orchestration surface. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
fregataa
force-pushed
the
feat/BA-6191-scope-creator-spec
branch
3 times, most recently
from
80838db to
3a9f205
Compare
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The single-call-site _build_role_row_from_preset/_build_permission_row_from_preset helpers are inlined into _collect_role_entries_for_scope_type. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Move scope provisioning/teardown orchestration into base as execute_scope_creator / execute_scope_purger, reusing the generic execute_creator / execute_bulk_creator / execute_batch_purger primitives. ScopeCreator extends Creator and ScopePurger extends Purger so the scope-row insert/delete is delegated to the base functions directly; ScopeCreatorSpec carries the scope-extension hooks. Expose create_scope / purge_scope on WriteOps and drop the separate ScopeWriteOps class. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fregataa
force-pushed
the
feat/BA-6191-scope-creator-spec
branch
from
aafd369 to
93ae30b
Compare
ScopeContext is a shared scope locator used by both scope creation and teardown; defining it in scope_creator forced scope_purger to import from scope_creator. Move it to repositories/base/types.py so both import it from a neutral, model-light module. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Member
Author
|
Closed since we planned to refactor this part after #11814 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ScopeCreatorSpec/ScopePurgerSpecas composite coordinators for scope provisioning and teardown. Leaf sub-specs stay single-table.RBACWriterOpsclass ownscreate_scope/purge_scope. Provisioning inserts the scope row, snapshots a role + its permissions per active preset matching the new scope, and writes role-to-scope plus parent-scope association rows in a single transaction.Test plan
Resolves BA-6191