Skip to content

[ Registry ] Recheck authorization on cached resolution - permission changes#3495

Open
nhatghost wants to merge 1 commit into
orchestration-agent:mainfrom
nhatghost:fix-registry-auth-cache
Open

[ Registry ] Recheck authorization on cached resolution - permission changes#3495
nhatghost wants to merge 1 commit into
orchestration-agent:mainfrom
nhatghost:fix-registry-auth-cache

Conversation

@nhatghost
Copy link
Copy Markdown

Description

This PR addresses Issue #3464 by implementing a secure, reactive authorization cache validation mechanism on AgentRegistry to ensure permission changes immediately invalidate cached access results.

Key Enhancements

  1. Dynamic Auth Cache Verification: Configured the registry resolve() function to systematically track agent auth versions. Stale or modified permissions now prompt cache eviction and log an audit warning.
    1. Granular Auth Auditing: Added self._authorization_audit tracking detailed security events (authorization_denied, cached_resolution_rejected, permissions_updated) while explicitly omitting raw runtime payloads to avoid data leakage.
    1. Cache Isolation & Deep Copying: All cache operations systematically employ deepcopy() to prevent in-memory mutation side-effects and guarantee complete thread-safe state isolation.
    1. Rigorous Tests: Added tests/test_registry_authorization_cache.py which covers rechecking cached resolution after permission updates, stale entry eviction, and runtime payload omission.
    1. Resolved Deadlocks & Windows compatibility: Applied conditional resource imports and reentrant locking (RLock) in metrics to ensure clean local development environments. All unit tests pass cleanly!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant