Skip to content

Commit aac7f08

Browse files
samrusaniSami Rusani
samrusani
and
Sami Rusani
authored
Phase 14 security end: harden owner writes and secrets (#183)
Co-authored-by: Sami Rusani <sr@samirusani>
1 parent 3444449 commit aac7f08

9 files changed

Lines changed: 573 additions & 24 deletions

‎.github/workflows/publish-npm.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2424

2525
- name: Setup Node
26-
uses: actions/setup-node@v4
26+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
2727
with:
2828
node-version: 20
2929
registry-url: https://registry.npmjs.org
@@ -73,7 +73,7 @@ jobs:
7373
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
7474

7575
- name: Setup Node
76-
uses: actions/setup-node@v4
76+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
7777
with:
7878
node-version: 20
7979
registry-url: https://registry.npmjs.org

‎.github/workflows/security-scans.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
fetch-depth: 0
2525

2626
- name: Run gitleaks
27-
uses: gitleaks/gitleaks-action@v2
27+
uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
2828
env:
2929
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3030

@@ -46,12 +46,12 @@ jobs:
4646
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
4747

4848
- name: Initialize CodeQL
49-
uses: github/codeql-action/init@v3
49+
uses: github/codeql-action/init@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3
5050
with:
5151
languages: ${{ matrix.language }}
5252

5353
- name: Autobuild
54-
uses: github/codeql-action/autobuild@v3
54+
uses: github/codeql-action/autobuild@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3
5555

5656
- name: Analyze
57-
uses: github/codeql-action/analyze@v3
57+
uses: github/codeql-action/analyze@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3

‎apps/api/alembic/versions/20260416_0066_hosted_control_plane_owner_writes.py‎

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
"""Restrict hosted control-plane writes to workspace owners."""
2+
3+
from __future__ import annotations
4+
5+
from alembic import op
6+
7+
8+
revision = "20260416_0066"
9+
down_revision = "20260416_0065"
10+
branch_labels = None
11+
depends_on = None
12+
13+
_UPGRADE_DROP_STATEMENTS = (
14+
"DROP POLICY IF EXISTS workspace_model_pack_bindings_workspace_access ON workspace_model_pack_bindings",
15+
"DROP POLICY IF EXISTS model_packs_workspace_access ON model_packs",
16+
"DROP POLICY IF EXISTS provider_capabilities_workspace_access ON provider_capabilities",
17+
"DROP POLICY IF EXISTS model_providers_workspace_access ON model_providers",
18+
)
19+
20+
_UPGRADE_CREATE_STATEMENTS = (
21+
"""
22+
CREATE POLICY model_providers_select_access ON model_providers
23+
FOR SELECT
24+
USING (app.hosted_workspace_access_allowed(workspace_id));
25+
""",
26+
"""
27+
CREATE POLICY model_providers_insert_owner_access ON model_providers
28+
FOR INSERT
29+
WITH CHECK (app.hosted_workspace_owner_allowed(workspace_id));
30+
""",
31+
"""
32+
CREATE POLICY model_providers_update_owner_access ON model_providers
33+
FOR UPDATE
34+
USING (app.hosted_workspace_owner_allowed(workspace_id))
35+
WITH CHECK (app.hosted_workspace_owner_allowed(workspace_id));
36+
""",
37+
"""
38+
CREATE POLICY model_providers_delete_owner_access ON model_providers
39+
FOR DELETE
40+
USING (app.hosted_workspace_owner_allowed(workspace_id));
41+
""",
42+
"""
43+
CREATE POLICY provider_capabilities_select_access ON provider_capabilities
44+
FOR SELECT
45+
USING (app.hosted_workspace_access_allowed(workspace_id));
46+
""",
47+
"""
48+
CREATE POLICY provider_capabilities_insert_owner_access ON provider_capabilities
49+
FOR INSERT
50+
WITH CHECK (app.hosted_workspace_owner_allowed(workspace_id));
51+
""",
52+
"""
53+
CREATE POLICY provider_capabilities_update_owner_access ON provider_capabilities
54+
FOR UPDATE
55+
USING (app.hosted_workspace_owner_allowed(workspace_id))
56+
WITH CHECK (app.hosted_workspace_owner_allowed(workspace_id));
57+
""",
58+
"""
59+
CREATE POLICY provider_capabilities_delete_owner_access ON provider_capabilities
60+
FOR DELETE
61+
USING (app.hosted_workspace_owner_allowed(workspace_id));
62+
""",
63+
"""
64+
CREATE POLICY model_packs_select_access ON model_packs
65+
FOR SELECT
66+
USING (app.hosted_workspace_access_allowed(workspace_id));
67+
""",
68+
"""
69+
CREATE POLICY model_packs_insert_owner_access ON model_packs
70+
FOR INSERT
71+
WITH CHECK (app.hosted_workspace_owner_allowed(workspace_id));
72+
""",
73+
"""
74+
CREATE POLICY model_packs_update_owner_access ON model_packs
75+
FOR UPDATE
76+
USING (app.hosted_workspace_owner_allowed(workspace_id))
77+
WITH CHECK (app.hosted_workspace_owner_allowed(workspace_id));
78+
""",
79+
"""
80+
CREATE POLICY model_packs_delete_owner_access ON model_packs
81+
FOR DELETE
82+
USING (app.hosted_workspace_owner_allowed(workspace_id));
83+
""",
84+
"""
85+
CREATE POLICY workspace_model_pack_bindings_select_access ON workspace_model_pack_bindings
86+
FOR SELECT
87+
USING (app.hosted_workspace_access_allowed(workspace_id));
88+
""",
89+
"""
90+
CREATE POLICY workspace_model_pack_bindings_insert_owner_access ON workspace_model_pack_bindings
91+
FOR INSERT
92+
WITH CHECK (app.hosted_workspace_owner_allowed(workspace_id));
93+
""",
94+
"""
95+
CREATE POLICY workspace_model_pack_bindings_update_owner_access ON workspace_model_pack_bindings
96+
FOR UPDATE
97+
USING (app.hosted_workspace_owner_allowed(workspace_id))
98+
WITH CHECK (app.hosted_workspace_owner_allowed(workspace_id));
99+
""",
100+
"""
101+
CREATE POLICY workspace_model_pack_bindings_delete_owner_access ON workspace_model_pack_bindings
102+
FOR DELETE
103+
USING (app.hosted_workspace_owner_allowed(workspace_id));
104+
""",
105+
)
106+
107+
_DOWNGRADE_DROP_STATEMENTS = (
108+
"DROP POLICY IF EXISTS workspace_model_pack_bindings_delete_owner_access ON workspace_model_pack_bindings",
109+
"DROP POLICY IF EXISTS workspace_model_pack_bindings_update_owner_access ON workspace_model_pack_bindings",
110+
"DROP POLICY IF EXISTS workspace_model_pack_bindings_insert_owner_access ON workspace_model_pack_bindings",
111+
"DROP POLICY IF EXISTS workspace_model_pack_bindings_select_access ON workspace_model_pack_bindings",
112+
"DROP POLICY IF EXISTS model_packs_delete_owner_access ON model_packs",
113+
"DROP POLICY IF EXISTS model_packs_update_owner_access ON model_packs",
114+
"DROP POLICY IF EXISTS model_packs_insert_owner_access ON model_packs",
115+
"DROP POLICY IF EXISTS model_packs_select_access ON model_packs",
116+
"DROP POLICY IF EXISTS provider_capabilities_delete_owner_access ON provider_capabilities",
117+
"DROP POLICY IF EXISTS provider_capabilities_update_owner_access ON provider_capabilities",
118+
"DROP POLICY IF EXISTS provider_capabilities_insert_owner_access ON provider_capabilities",
119+
"DROP POLICY IF EXISTS provider_capabilities_select_access ON provider_capabilities",
120+
"DROP POLICY IF EXISTS model_providers_delete_owner_access ON model_providers",
121+
"DROP POLICY IF EXISTS model_providers_update_owner_access ON model_providers",
122+
"DROP POLICY IF EXISTS model_providers_insert_owner_access ON model_providers",
123+
"DROP POLICY IF EXISTS model_providers_select_access ON model_providers",
124+
)
125+
126+
_DOWNGRADE_CREATE_STATEMENTS = (
127+
"""
128+
CREATE POLICY model_providers_workspace_access ON model_providers
129+
FOR ALL
130+
USING (app.hosted_workspace_access_allowed(workspace_id))
131+
WITH CHECK (app.hosted_workspace_access_allowed(workspace_id));
132+
""",
133+
"""
134+
CREATE POLICY provider_capabilities_workspace_access ON provider_capabilities
135+
FOR ALL
136+
USING (app.hosted_workspace_access_allowed(workspace_id))
137+
WITH CHECK (app.hosted_workspace_access_allowed(workspace_id));
138+
""",
139+
"""
140+
CREATE POLICY model_packs_workspace_access ON model_packs
141+
FOR ALL
142+
USING (app.hosted_workspace_access_allowed(workspace_id))
143+
WITH CHECK (app.hosted_workspace_access_allowed(workspace_id));
144+
""",
145+
"""
146+
CREATE POLICY workspace_model_pack_bindings_workspace_access ON workspace_model_pack_bindings
147+
FOR ALL
148+
USING (app.hosted_workspace_access_allowed(workspace_id))
149+
WITH CHECK (app.hosted_workspace_access_allowed(workspace_id));
150+
""",
151+
)
152+
153+
154+
def _execute_statements(statements: tuple[str, ...]) -> None:
155+
for statement in statements:
156+
op.execute(statement)
157+
158+
159+
def upgrade() -> None:
160+
_execute_statements(_UPGRADE_DROP_STATEMENTS)
161+
_execute_statements(_UPGRADE_CREATE_STATEMENTS)
162+
163+
164+
def downgrade() -> None:
165+
_execute_statements(_DOWNGRADE_DROP_STATEMENTS)
166+
_execute_statements(_DOWNGRADE_CREATE_STATEMENTS)

0 commit comments

Comments
 (0)