Feat: move resource pools check to authz by SalimKayal · Pull Request #1248 · SwissDataScienceCenter/renku-data-services

SalimKayal · 2026-03-30T14:07:38Z

Summary

This PR implements ResourcePool authorization in SpiceDB/Authzed, enabling centralized access control while maintaining feature parity with the DB-based implementation.

What Changed

Authzed Schema (v9):

Added resource_pool resource type with relations: member, prohibited, public_viewer, resource_pool_platform
Permissions: use = (member + public_viewer + admin) - prohibited, write = admin-only
Supporting Code:
Extended ResourceType enum with resource_pool
Updated _AuthzConverter.resource_pool() and related methods to handle int IDs
Enhanced permission checking signatures throughout authz module
Migration:
Alembic migration cd424c01676e deploys Authzed schema v9
Schema-only migration (data migration deferred for safety)

Tests

Authorization tests: member/prohibited/public patterns, admin bypass, isolation
Schema Validation: SpiceDB zed validate confirms v9 schema correctness

Deferred Items

Core Logic Updates: Update CRC core and db modules to use Authzed for membership checks
API Refactoring: Update blueprints to leverage updated core logic
Cleanup Migration: Remove old DB tables after Phase 1 verification
Authz Relationship: Add groups and projects for authorization.

PR stack

(base/this) Feat: move resource pools check to authz #1248
- Feat: authz resource pools feature parity #1256

/deploy renku=salimkayal-add-AUTHZ-config-to-k8s-watcher

coveralls · 2026-03-30T16:57:22Z

Coverage Report for CI Build 24656849513

Warning

No base build found for commit bd0bf2e on Feat/Move-Resource-Pool-Authorization-To-Authzed.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 86.387%

Details

Patch coverage: 29 uncovered changes across 3 files (294 of 323 lines covered, 91.02%).

Uncovered Changes

File	Changed	Covered	%
components/renku_data_services/crc/db.py	129	115	89.15%
components/renku_data_services/authz/authz.py	99	91	91.92%
components/renku_data_services/migrations/versions/cd424c01676e_add_resource_pool_authorization_schema.py	70	63	90.0%

Coverage Regressions

Requires a base build to compare against. How to fix this →

Coverage Stats


Relevant Lines:	29832
Covered Lines:	25771
Line Coverage:	86.39%
Coverage Strength:	1.5 hits per line

💛 - Coveralls

sgaist

I am no specialist of Authz but the code in itself looks good.

Just some minor things.

olevski

Overarching comment the target is main can this go to a feature branch? Mainly because I think we should test the migration on a ci deployment we artificially put a lot of users into. And then see if the migration is quick enough. So for now we can merge into a feature branch and you can continue with your work and then when we merge the feature branch to main we do the test.

olevski · 2026-04-15T13:53:42Z

For example on renkulab.io we have a total of 598 resource pool member entries spread across 34 resource pools. We can use this info to test.

leafty

Can we merge this into a feature branch? This code is not "usable" as is in main.

* feat: add ResourcePool and membership types * feat: add ResourcePool as a supported authorization resource * feat: add member and prohibited relationships * refactor: authz_change decorator for multiple APIUser args * fix: session commit responsibility to session creator * refactor: move authorization logic to authz schema * feat: wire Authz into dependency graphs * feat: update blueprint func for single rp * fix: use proper non admin user in visibility tests * feat: visibility toggle test for rp * feat: update test utils setup for rp_repo with authz * refactor: update functions for authz usage * feat: new authorization tests * fix: use NonCachingAuthz in nb_config for tests * squashme: remove debug print * squashme: fix comments * fix: edge case for noop visibility change * refactor: authz consistency * fix: call spicedb only on authz updates * chore: fix error message * refactor: DRY some stuff * squashme: remove commented out code * fix: await resource pool creation with authz

RenkuBot · 2026-04-20T08:41:39Z

You can access the deployment of this PR at https://renku-ci-ds-1248.dev.renku.ch

RenkuBot · 2026-04-20T13:26:31Z

Tearing down the temporary RenkuLab deployment for this PR.

SalimKayal requested review from leafty and sgaist March 30, 2026 14:07

SalimKayal force-pushed the feat/move-resource-pools-check-to-authz branch from c19e6d0 to d4c7f78 Compare March 30, 2026 15:12

sgaist requested changes Mar 31, 2026

View reviewed changes

Comment thread ...nku_data_services/migrations/versions/cd424c01676e_add_resource_pool_authorization_schema.py Outdated

Comment thread test/components/renku_data_services/authz/test_authorization.py Outdated

leafty reviewed Apr 7, 2026

View reviewed changes

Comment thread components/renku_data_services/authz/schemas.py Outdated

SalimKayal commented Apr 10, 2026

View reviewed changes

Comment thread components/renku_data_services/authz/schemas.py Outdated

SalimKayal force-pushed the feat/move-resource-pools-check-to-authz branch from 7dab40e to 378a7a0 Compare April 14, 2026 11:03

olevski requested changes Apr 15, 2026

View reviewed changes

Comment thread components/renku_data_services/authz/schemas.py Outdated

Comment thread ...nku_data_services/migrations/versions/cd424c01676e_add_resource_pool_authorization_schema.py

SalimKayal force-pushed the feat/move-resource-pools-check-to-authz branch from 84d72b3 to f9f5b0b Compare April 15, 2026 14:25

SalimKayal commented Apr 16, 2026

View reviewed changes

Comment thread test/bases/renku_data_services/data_api/test_migrations.py

SalimKayal mentioned this pull request Apr 17, 2026

Feat: authz resource pools feature parity #1256

Merged

SalimKayal marked this pull request as ready for review April 17, 2026 11:15

SalimKayal requested a review from a team as a code owner April 17, 2026 11:15

olevski approved these changes Apr 17, 2026

View reviewed changes

leafty requested changes Apr 17, 2026

View reviewed changes

SalimKayal added 13 commits April 17, 2026 15:34

feat: update schema for authzed

d8f54df

feat(authz): add ResourcePool as a supported authorization resource

d82a5cf

feat(authz): add member and prohibited relationship types

b5573e7

feat(db): add ResourcePool authz schema migration, copy membership

216b90f

chore(authz): update schema tests for resource pools

b6d6ad1

feat(authz): add the USE Scope

89f8dd9

chore(tests): update the authorization tests for resource pools

2f94098

squashme: copy-paste artifact

5c6936d

squashme: format

ab945d9

refactor: use vars instead of magic strings

b2e1bef

fix: move migration head

625be66

feat: add test for migration

2942d71

refactor: harmonize nomenclature

aa3ad41

SalimKayal force-pushed the feat/move-resource-pools-check-to-authz branch from 63522bf to aa3ad41 Compare April 17, 2026 13:35

SalimKayal changed the base branch from main to Feat/Move-Resource-Pool-Authorization-To-Authzed April 17, 2026 13:36

leafty approved these changes Apr 17, 2026

View reviewed changes

SalimKayal requested a review from sgaist April 17, 2026 22:16

SalimKayal merged commit 15bfb56 into Feat/Move-Resource-Pool-Authorization-To-Authzed Apr 20, 2026
47 of 57 checks passed

SalimKayal deleted the feat/move-resource-pools-check-to-authz branch April 20, 2026 13:25

SalimKayal mentioned this pull request Apr 20, 2026

Feat: ResourcePool Authorization via Authzed/SpiceDB #1266

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat: move resource pools check to authz#1248

Feat: move resource pools check to authz#1248
SalimKayal merged 14 commits intoFeat/Move-Resource-Pool-Authorization-To-Authzedfrom
feat/move-resource-pools-check-to-authz

SalimKayal commented Mar 30, 2026 •

edited

Loading

Uh oh!

coveralls commented Mar 30, 2026 •

edited

Loading

Uh oh!

sgaist left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

olevski left a comment

Uh oh!

Uh oh!

Uh oh!

olevski commented Apr 15, 2026

Uh oh!

Uh oh!

leafty left a comment

Uh oh!

RenkuBot commented Apr 20, 2026

Uh oh!

Uh oh!

RenkuBot commented Apr 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

SalimKayal commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What Changed

Tests

PR stack

Uh oh!

coveralls commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 24656849513

Coverage: 86.387%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

sgaist left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

olevski left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

olevski commented Apr 15, 2026

Uh oh!

Uh oh!

leafty left a comment

Choose a reason for hiding this comment

Uh oh!

RenkuBot commented Apr 20, 2026

Uh oh!

Uh oh!

RenkuBot commented Apr 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

SalimKayal commented Mar 30, 2026 •

edited

Loading

coveralls commented Mar 30, 2026 •

edited

Loading