feat(BA-4147): Implement querier pattern for RBAC permission/scope fetchers #8432
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
size:XL
Contributor
There was a problem hiding this comment.
Pull request overview
This PR implements a BatchQuerier-based search pattern for RBAC permission and scope fetchers, providing SQL-level querying capabilities to replace in-memory filtering. The changes introduce new search infrastructure across data types, repository options, database sources, repositories, service actions, and services.
Changes:
- Added three new list result data types (PermissionGroupListResult, ScopedPermissionListResult, ObjectPermissionListResult) to support paginated search results
- Implemented conditions and orders classes for querying permission groups, scoped permissions, and object permissions with cursor-based pagination support
- Created search methods in the database source, repository, and service layers for all three entity types with proper pagination and filtering capabilities
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| src/ai/backend/manager/data/permission/permission_group.py | Added PermissionGroupListResult data type for paginated search results |
| src/ai/backend/manager/data/permission/permission.py | Added ScopedPermissionListResult data type for paginated search results |
| src/ai/backend/manager/data/permission/object_permission.py | Added ObjectPermissionListResult data type for paginated search results |
| src/ai/backend/manager/repositories/permission_controller/options.py | Implemented query conditions and orders for permission groups, scoped permissions, and object permissions with cursor-based pagination support |
| src/ai/backend/manager/repositories/permission_controller/db_source/db_source.py | Added database-level search methods for permission groups, scoped permissions, and object permissions using execute_batch_querier |
| src/ai/backend/manager/repositories/permission_controller/repository.py | Added repository-level wrapper methods with resilience decorators for all three search operations |
| src/ai/backend/manager/services/permission_contoller/actions/search_permission_groups.py | Created SearchPermissionGroupsAction and SearchPermissionGroupsActionResult classes |
| src/ai/backend/manager/services/permission_contoller/actions/search_scoped_permissions.py | Created SearchScopedPermissionsAction and SearchScopedPermissionsActionResult classes |
| src/ai/backend/manager/services/permission_contoller/actions/search_object_permissions.py | Created SearchObjectPermissionsAction and SearchObjectPermissionsActionResult classes |
| src/ai/backend/manager/services/permission_contoller/actions/init.py | Exported the new search action classes for external use |
| src/ai/backend/manager/services/permission_contoller/service.py | Implemented service-level methods that orchestrate the search operations by calling repository methods and transforming results |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
fregataa
force-pushed
the
feat/BA-4147-rbac-querier-pattern
branch
2 times, most recently
from
f1d2ab1 to
2e5ca4e
Compare
jopemachine
reviewed
Jan 30, 2026
| @classmethod | ||
| def operation_type(cls) -> str: | ||
| return "search" | ||
|
|
Member
There was a problem hiding this comment.
Like SearchScopedPermissionsAction, this is also a RoleAction, so shouldn’t we specify the operation_type more concretely as search_object_permission?
Member
Author
There was a problem hiding this comment.
We decided to declare operation type as enum
…tchers Add BatchQuerier-based search methods for permission groups, scoped permissions, and object permissions across all layers (options, data types, DB source, repository, service actions).
… new Conditions/Orders classes
Add tests for search_roles, search_permission_groups, search_scoped_permissions, and search_object_permissions covering filtering and ordering capabilities.
fregataa
force-pushed
the
feat/BA-4147-rbac-querier-pattern
branch
from
2e5ca4e to
7d38e5a
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
resolves #8429 (BA-4147)
Summary
Checklist: (if applicable)
ai.backend.testdocsdirectory