fix(grpc): add scope enforcement helper and keepalive options (KI-72)

fix(grpc): add scope enforcement helper and keepalive options #72

Merged

wasabi opened 3 days ago

Changes

Add require_scope(resource, action) helper to grpc/auth.py
- Reads scopes from grpc_auth_context, aborts with PERMISSION_DENIED on mismatch
- Services can adopt incrementally: call require_scope() at top of each RPC
Add keepalive options to grpc.server():
- keepalive_time_ms=30000, keepalive_timeout_ms=10000
- keepalive_permit_without_calls=True
- max_connection_age_ms=3600000 (1 hour), max_connection_age_grace_ms=30000

Note

Scope checks not yet added to individual service methods (incremental adoption via require_scope() helper).

Commits were merged into target branch

fix(grpc): add scope enforcement helper and keepalive options

- Add require_scope(resource, action) helper to grpc/auth.py
  - Reads scopes from grpc_auth_context, aborts with PERMISSION_DENIED on mismatch
  - Services can adopt incrementally: call require_scope() at top of each RPC
- Add keepalive options to grpc.server():
  - keepalive_time_ms=30000, keepalive_timeout_ms=10000
  - keepalive_permit_without_calls=True
  - max_connection_age_ms=3600000 (1 hour), max_connection_age_grace_ms=30000
- Scope checks not yet added to individual service methods (incremental adoption)

3 days ago

dc22b08b

wasabi merged 3 days ago
Login to comment

Submitter	wasabi
Target	main
Source	feat/platform-hardening

Jobs

Merge Strategy

Create Merge Commit

Watchers (1)

Reference

pull request KI-72