27 lines
1.1 KiB
Markdown
27 lines
1.1 KiB
Markdown
|
# Task ID: 116
|
||
|
|
|
||
|
|
**Title:** One-shot RBAC binding backfill migration
|
||
|
|
|
||
|
|
**Status:** pending
|
||
|
|
|
||
|
|
**Dependencies:** 115
|
||
|
|
|
||
|
|
**Priority:** high
|
||
|
|
|
||
|
|
**Description:** Implement guarded startup migration to rewrite existing 'tasks' bindings to 'inference-tasks' so pre-existing grants continue authorizing inference endpoints
|
||
|
|
|
||
|
|
**Details:**
|
||
|
|
|
||
|
|
In src/mcpd/src/main.ts or a new bootstrap module:
|
||
|
|
1. Read system settings from SYSTEM_SETTINGS_SECRET (see src/mcpd/src/bootstrap/system-settings.ts pattern)
|
||
|
|
2. Check for boolean key 'rbacTasksBackfillComplete'
|
||
|
|
3. If false/missing: iterate rbacRepo.findAll(), for each RbacDefinition row, rewrite roleBindings where resource === 'tasks' to resource: 'inference-tasks'
|
||
|
|
4. Use rbacRepo.update() to persist changes
|
||
|
|
5. Set 'rbacTasksBackfillComplete': true in system settings after completion
|
||
|
|
6. Wildcard bindings (resource: '*') are untouched
|
||
|
|
7. Model on migrateAdminRole pattern in main.ts
|
||
|
|
|
||
|
|
**Test Strategy:**
|
||
|
|
|
||
|
|
Unit test: create RbacDefinition with resource:'tasks', run backfill, verify resource changed to 'inference-tasks'. Test idempotency: run twice, verify no duplicate rewrites. Test wildcard unchanged.
|