Skip to content

rbac: scoped lane binding tests over the dt64 socket (D-DRDT-SPLIT-1 S4, tests only) - #2024

Merged
AdaWorldAPI merged 3 commits into
mainfrom
ccr-ca0562e7-hudvlz-s4-scoped
Nov 11, 2026
Merged

rbac: scoped lane binding tests over the dt64 socket (D-DRDT-SPLIT-1 S4, tests only)#2024
AdaWorldAPI merged 3 commits into
mainfrom
ccr-ca0562e7-hudvlz-s4-scoped

Conversation

@AdaWorldAPI

@AdaWorldAPI AdaWorldAPI commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

This is S4 of dr-widefieldmask-dt-classview-v1.md §5, test half only. The production steps S4b-1 and S4b-2 are not in this PR.

Stacked on #2021 (S8). This branch contains #2021's commits; merge #2021 first.

What the tests show

crates/lance-graph-rbac/tests/scoped_lane_binding.rs has 18 tests. Each binds dt64 lanes under the field mask and the scope that authorize_scoped returns. lance-graph-dt64 is added as a dev-dependency only.

Fields

  • Each role binds exactly the requested fields it is allowed to see. Two roles overlap in one field.
  • A decision other than allow makes no field bindable.

Readers

  • One role cannot bind through another role's socket.
  • One role's guards are refused under another role's scope.
  • A binding checked through another reader's socket is refused.

Rows

  • Row planes admit exactly each role's rows.
  • A plane is refused after the source moves, and is then recomputed.
  • A plane prepared for one decision is refused for another decision.
  • An unscoped decision prepares no plane, and neither does a reserved predicate.

Findings pinned as current behaviour

Each finding is pinned so that the step that fixes it turns the test from red to green.

  • A4: the raw field_mask of a refused decision would bind every requested field. visible_fields is the safe accessor.
  • A5: bind_lanes admits an empty request.
  • B3: a LaneBinding on its own does not know its reader. S4b-1 fixes this.
  • B5: a copied scope id binds another reader's fields. S4b-2 fixes this with a sealed reader scope.
  • R2: ScopeSpec::admits alone ignores the tenant.

Evidence

  • cargo test -p lance-graph-rbac: 46 + 18 pass. clippy -D warnings and fmt are clean.
  • Disable runs on production code. Each anchor was asserted to occur exactly once, each run turned its test red, and the file was restored afterwards.
Test Disable
A1 WideFieldMask::intersect computes a | b instead of a & b
A3 ScopedDecision::visible_fields returns the mask for every decision
A4 the refused decision's raw mask is EMPTY
B1 the scope check in admit_lane never fires
B2 the scope guard in dr.rs never fires
B4 the MappingChanged arm in LaneBinding::check is ignored
R2 ScopeSpec::admits returns false

The remaining disables (A2, B6, R1, R3–R6) are edits in the test's own fixture and were not run.

Correction (2026-11-11)

An earlier version of this description listed R7 as a gap and as an open decision ("stricter than EXO-255"). That was wrong. A lane binding addresses one version of the frame, and versions are not compacted, so the bound version stays what the binding names. A source advance is a new version: check refuses the old binding, and binding again against the new seal reads the new version. The test is renamed a_binding_addresses_one_version_and_a_source_advance_is_read_by_binding_again and now also asserts the rebind, in the follow-up PR.

Open decision

This point is recorded for the operator; this PR does not implement it.

  • S4b-2. It is unsettled whether a sealed reader scope replaces the bare Scope in the lane socket or sits beside it, what the seal binds, and where the issuer lives.

Generated by Claude Code

@claude
dt64: lane binding refuses a predicate change at a bound position (S8)
3ca0838 
bind_lanes records the predicate IRI each bound position resolved to; the
hot check compares it after lane_of and refuses with PredicateChanged
{ class, field } when a view reorder put another predicate at that
position. Label-only renames and reorders outside the bound positions
still admit. No hashing on the hot path.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XAqKMPJjVvasjwqhjJ6c9p
@claude
plan: S8 wording follows the shipped predicate comparison
08eb7c3 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XAqKMPJjVvasjwqhjJ6c9p
@claude
rbac: scoped lane binding tests over the dt64 socket (S4, tests only)
00a1239 
18 tests bind dt64 lanes under the field mask and scope an authorization
decision yields: each role binds exactly its visible requested fields, a
non-allow decision binds nothing, a binding is refused through another
reader's socket and scope, and row planes admit exactly each role's rows and
are refused after the source moves or for another decision. Four findings
pin current gaps (a binding does not know its reader; a copied scope id
binds another reader's fields; admits ignores the tenant; a source move also
refuses the address binding) for S4b-1 / S4b-2 to turn.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XAqKMPJjVvasjwqhjJ6c9p
@coderabbitai

coderabbitai Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

  • Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: fc14dba7-8842-4d42-a501-f2d719b0bdab
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@AdaWorldAPI
AdaWorldAPI marked this pull request as ready for review November 11, 2026 19:57
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-11T19:58:46.081813Z 00a1239 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@AdaWorldAPI
AdaWorldAPI merged commit c72eb72 into main Nov 11, 2026
15 checks passed
This was referenced Nov 11, 2026
Merged
Merged
AdaWorldAPI added a commit that referenced this pull request Nov 11, 2026
@AdaWorldAPI
Merge pull request #2025 from AdaWorldAPI/ccr-ca0562e7-hudvlz-r7-correct
9351f70 
rbac tests: a lane binding addresses one version (correct the R7 framing from #2024)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@AdaWorldAPI @claude