feat(server): implement Resource Scoping for tasks and push notifications#709
feat(server): implement Resource Scoping for tasks and push notifications#709sokoliva wants to merge 21 commits intoa2aproject:1.0-devfrom
Resource Scoping for tasks and push notifications#709Conversation
…fications` Introduces caller indentity isolation to ensure clients only access authorized resources, as mandated by the A2A spec. - Add 'owner' field to `TaskMixin` and `PushNotificationConfig` database models. - Add 'last_updated' field to `TaskMixin` for optimized sorting and indexing. - Update `DatabaseTaskStore`, `InMemoryTaskStore` and `DatabasePushNotificationConfigStore` to use `OwnerResolver`. - Add relevant Unit tests. - Add Alembic configuration to enable users to update their own databases with non-optional `owner` field in `tasks` table.
Summary of ChangesHello @sokoliva, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the server's data management capabilities by implementing robust resource scoping for tasks and push notification configurations, ensuring that users can only access their own data. It also introduces a flexible 'ListTasks' API, enabling efficient retrieval and management of tasks with advanced filtering and pagination. The integration of Alembic provides a structured approach to future database schema evolution. Highlights
Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces resource scoping by adding an owner field to tasks and push notification configurations, which is a great step towards multi-tenancy and security. The implementation across the database and in-memory stores is consistent. I've also noticed the addition of Alembic for database migrations, which is excellent for managing schema changes. My feedback focuses on improving the Alembic configuration, strengthening the data model for timestamps, and making the owner resolution logic more robust.
…to resource-scoping
- fix elmbic README.md error - make ServerCallContext optional in OwnerResolver
…thon into resource-scoping
| owner_tasks = self.tasks.get(owner, {}) | ||
| tasks = list(owner_tasks.values()) |
There was a problem hiding this comment.
nit: this code uses a bit different pattern compared to get, I suggest to either use fallback to an empty dict in both places or explicit if here as well.
Same for delete. Maybe a helper private get_owner_tasks can be useful here.
| indent-style = "space" | ||
|
|
||
|
|
||
| [tool.alembic] |
There was a problem hiding this comment.
nit: I suggest linking original docs via comment here and remove commented out values as they add some noise to the file.
There was a problem hiding this comment.
Question on the developer experience here: if one needs to migrate their database - which steps are required? Currently readme mixes information for the package developers on how to add more migrations with the usage for integrations (how to run migrations).
I also believe that it assumes cloning the repository in order to run them, as it usually doesn't happen when one just uses package as a dependency. This creates some risk as one should make sure they switched to the appropriate commit to avoid applying migrations from main branch not yet released to PyPi?
Is it possible to distribute migrations together with the package itself and provide instructions on running them against the installed package version? We can also consider optional parameter which one may use to automatically apply migrations at runtime (default to False).
References:
…tionConfigStore` methods.
…thon into resource-scoping
3 participants
Description
Introduces caller indentity isolation to ensure clients only access authorized resources, as mandated by the A2A spec.
TaskMixinandPushNotificationConfigdatabase models.TaskMixinfor optimized sorting and indexing.DatabaseTaskStore,InMemoryTaskStoreandDatabasePushNotificationConfigStoreto useOwnerResolver.ownerfield intaskstable.Note
src/a2a/server/tasks/database_task_store.pylistmethod, Gemini suggested a refactor of pagination. I thoroughly reviewed it and comfirmed that the logic is the same and that readability of code improved so I decided to accept it.delete_infomethod. Whenconfig_idis None and onlytask_idwas provided it would search for configs mapped to task_id with config.id=task_id, contrary todelete_infomethod of DatabasePushNotificationConfigStore where if config_id is None, all configurations for the task are deleted. Unfortunately, I did not find intended behavior in the spec, but behavior ofDatabasePushNotificationConfigStore'sdelete_infoseems more logical.Breaking changes
added non-optional owner field to the Task Model. Use alembic configuration to update your database.
Ensure the tests and linter pass (Run
bash scripts/format.shfrom the repository root to format)Appropriate docs were updated (if necessary)
Fixes #610 🦕