Repository navigation
Reuse authorized existing atespaces without global creation permission #511
Description
AX’s Substrate API identity with editor access to an operator-created atespace still calls
CreateAtespace through EnsureAtespace. That operation requires global
creation permission even when the scope already exists, so task reconciliation
can fail despite the identity having sufficient access within its own scope.
Reproduction: precreate a scope, grant the AX identity editor access only there,
and reconcile a task in that scope. The current client attempts the global create
operation. The fix reads the scope first, creates only after NotFound, and
preserves permission and other read errors. A concurrent AlreadyExists remains
successful.
Branch: https://github.com/eren23/ax/tree/fix/reuse-authorized-atespace
Compare: main...eren23:ax:fix/reuse-authorized-atespace
The branch changes the client and its test fixtures on AX 0f085aa, without an API
module upgrade. Tests cover existing/editor access, missing scopes, denied reads
and concurrent creation. In the earlier combined-stack live validation, AX used
editor access on precreated scopes and all eight e2e tests passed against
Substrate 173cd071. Independently, scope branch 849035e passed the full
Go unit suite and race tests for internal/substrate and internal/controller
on native Linux amd64 with Go 1.27.1. A negative control reproduced the exact
missing-controller-mock failure, followed by passing corrected tests. This branch also passed go mod tidy without changing go.mod or go.sum,
and built ax, ax-server and ax-task-runner. This standalone batch did not
run live e2e tests.
Would a collaborator be willing to open the focused PR from this branch while
external PR creation is restricted?
Activity