feat(a2a-nats): spicedb-backed import gate behind feature flag - #309
Merged
Conversation
yordis
commented
Jun 17, 2026
yordis
commented
Member
- Deployments with a SpiceDB Permissions API can now plug it into the catalog import gate so federated agent-card imports get checked against the tenant's permissions graph instead of falling back to AllowAll on every read.
- Routing authzed + tonic + moka through a 'spicedb' Cargo feature keeps the gRPC/cache compile cost off deployments that don't authorise imports against an external graph, so the lightweight integration profile stays lightweight.
Deployments with a SpiceDB Permissions API can now plug it into the catalog import gate so federated agent-card imports get checked against the tenant's permissions graph; everyone else stays on the AllowAll default. Routing the authzed/tonic/moka deps through a 'spicedb' feature keeps the compile cost off deployments that don't authorise imports against an external graph. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
PR SummaryMedium Risk Overview Enable it with the Configuration helpers read Reviewed by Cursor Bugbot for commit acc40e0. Bugbot is set up for automated code reviews on this repo. Configure here. |
|
Caution Review failedPull request was closed or merged during review WalkthroughAdds a feature-gated ChangesSpiceDB-backed Import Gate
Sequence Diagram(s)sequenceDiagram
participant Caller
participant SpiceDbImportGate
participant ZedTokenCache
participant BulkImportPermissionCheck as Authzed gRPC
Caller->>SpiceDbImportGate: permit(principal, context)
SpiceDbImportGate->>SpiceDbImportGate: spicedb_subject_from_principal(principal)
alt No subject mapping
SpiceDbImportGate-->>Caller: Deny (no subject)
end
SpiceDbImportGate->>ZedTokenCache: get(ImportGateCacheKey)
ZedTokenCache-->>SpiceDbImportGate: Option<ZedTokenSnapshot>
SpiceDbImportGate->>Authzed gRPC: check_bulk_permissions(agent_card / view, optional consistency)
alt Transport error
Authzed gRPC-->>SpiceDbImportGate: Err(Status)
SpiceDbImportGate-->>Caller: Deny (fail closed)
end
Authzed gRPC-->>SpiceDbImportGate: CheckBulkPermissionsResponse
alt HasPermission + zed_token present
SpiceDbImportGate->>ZedTokenCache: insert(key, checked_at token)
SpiceDbImportGate-->>Caller: Allow
else
SpiceDbImportGate-->>Caller: Deny
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Code Coverage SummaryDetailsDiff against mainResults for commit: acc40e0 Minimum allowed coverage is ♻️ This comment has been updated with latest results |
yordis
changed the title
yordis
added
the
rust:coverage-baseline-reset
Live LiveBulkImportPermissionClient + try_from_env + resolve_import_gate need a real SpiceDB to exercise — they land in the integration PR alongside a smoke harness. This slice keeps the trait surface plus deny_only / configured constructors / check_import + all the testable helpers, and every remaining production line is now hit by a unit test so the coverage gate stops seeing this PR as a stream of new uncovered statements. Also collapses the impossible Response::Error arm into the closing wildcard — google.rpc.Status isn't publicly re-exported by spicedb-grpc-tonic, so the explicit arm can't be exercised in a unit test and fails closed the same way as the None case anyway. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
yordis
added a commit
that referenced
this pull request
Jun 18, 2026
Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.