Repository navigation
feat: register provider_keys.manage permission for the gateway's /v1 proxy - #79
Merged
Merged
Conversation
…proxy Reserved -- not yet enforced by any route, the same posture usage.read already has: the real authorization decision for provider-key management is manage_org, checked live by routes_organization_config.py's own require_org_permission_or_ platform_admin dependency, not this registry entry or any JWT permissions claim (org-scoped permissions are never embedded in a token). This just gives omnibioai-api-gateway's new /v1/provider-keys proxy a real, registered name to send as policy-engine context. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Small, registry-only addition supporting the paired omnibioai-api-gateway PR that exposes M14's BYOK provider-key storage through the public
/v1/provider-keys/{provider}surface.provider_keys.manage-- "reserved, not yet enforced by any route," the exact same postureusage.readalready has (its own "first real consumer" was the gateway'sGET /v1/usageproxy at M1).manage_org, enforced live byroutes_organization_config.py's ownrequire_org_permission_or_platform_admindependency -- not this registry entry, and not any JWTpermissionsclaim, since org-scoped permissions are never embedded in a token (they're resolved fresh per request against the caller's live membership).Test plan
pytest tests/test_permission_registry.py tests/test_platform_permissions_api.py-- 65 passed, including the updated exact-registry-size assertions (32 -> 33) and by-scope totals (both: 17 -> 18)🤖 Generated with Claude Code