ge-aerospace/shopdb-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bump plugin contract to 0.32.0 and register new plugin tables

Browse Source 
Exports caller_is_role on the plugin authorization surface. Additive name, so a minor bump. Scoped personal tokens are always refused by it, matching require_role, which stops a plugin from accidentally letting a scoped token inherit role authority from its owner.

Registers the tables added by the endpoint lock and policy hold work (endpointlocks, policyactionholds) plus the endpoint health tables in the alembic template, so plugin migrations see them and the ownership guard does not report them as unclaimed.
This commit is contained in:
benjamin.baker
2026-09-07 12:40:12 -04:00
parent 0d5b9730e3
commit 4c1d96b6ba
6 changed files with 36 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
shopdb/api/__init__.py
View File

@@ -70,7 +70,7 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
# Authorization decorators for gating plugin write routes
from shopdb.utils.authz import (require_permission, require_any_permission,
require_role, caller_holds)
require_role, caller_holds, caller_is_role)
# Service-token authorization for unattended plugin endpoints (collector,
# GE-Enforce fetch, ...): checks a scoped managed token without exposing token
@@ -380,6 +380,7 @@ __all__ = [
'require_permission',
'require_any_permission',
'caller_holds',
'caller_is_role',
'require_role',
'service_token_authorized',
'authorized_service_token',