feat(api-server): RBAC enforcement with scope-aware authorization#1660

Merged

mergify[bot] merged 64 commits into

mainfrom

jsell/feat/rbac-enforcement

Jun 9, 2026

Commits on Jun 5, 2026

Merge branch 'main' of https://github.com/ambient-code/platform
jsell-rh
committed
Merge branch 'main' of https://github.com/ambient-code/platform
jsell-rh
committed
feat(api-server): implement scope-aware RBAC enforcement

jsell-rh
and
claude
committed
feat(api-server): add gRPC RBAC authorization for watch streams

jsell-rh
and
claude
committed
test(api-server): add RBAC enforcement integration tests

jsell-rh
and
claude
committed
style(api-server): fix gofmt formatting in rbac package

jsell-rh
and
claude
committed
test(api-server): add RBAC enforcement e2e test script

jsell-rh
and
claude
committed
feat(api-server): wire RBAC list filtering and fix e2e test failures

jsell-rh
and
claude
committed
ci: add RBAC enforcement e2e test step to CI pipeline

jsell-rh
and
claude
committed
feat: new project button, escalation checks, e2e assertions

jsell-rh
and
claude
committed
fix(api-server): extract RBAC scope from request body for top-level POSTs

jsell-rh
and
claude
committed
fix(api-server): credential binding requires both credential:owner and project:owner

jsell-rh
and
claude
committed
test(api-server): comprehensive RBAC e2e covering 30+ spec scenarios

jsell-rh
and
claude
committed
fix(api-server): scoped escalation checks + generative e2e matrix

jsell-rh
and
claude
committed
fix(api-server): idempotent e2e cleanup + generative escalation matrix

jsell-rh
and
claude
committed
fix(api-server): close RBAC gaps in session sub-resources and role binding list

jsell-rh
and
claude
committed
fix(api-server): unique constraint on role_bindings + RBAC gap fixes

jsell-rh
and
claude
committed
test(api-server): red tests for audit findings — 13 failures

jsell-rh
and
claude
committed
fix(api-server): address 7 audit findings — PATCH escalation, list filtering, sub-resources

jsell-rh
and
claude
committed
fix(api-server): all 156 RBAC e2e tests passing — zero gaps

jsell-rh
and
claude
committed
fix(api-server): remove unused test helpers to fix CI lint

jsell-rh
and
claude
committed
test(api-server): red tests proving PATCH scope widening attack

jsell-rh
and
claude
committed
fix(api-server): close PATCH scope widening + nil sessionFactory guard

jsell-rh
and
claude
committed
fix(api-server): close platform:viewer→admin escalation + fail-closed ApplyListFilter

jsell-rh
and
claude
committed

Commits on Jun 6, 2026

Commits on Jun 8, 2026