Skip to content

Feat/GitHub issue agent rbac scope gating #619

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pdettori merged 8 commits into from
Jun 26, 2026
Merged

Feat/GitHub issue agent rbac scope gating #619

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
cd41783
initial rbac commit
omerboehm Jun 18, 2026
ca469bc
removing confing files
omerboehm Jun 18, 2026
3896cde
config and policy
omerboehm Jun 20, 2026
fd29c5a
Merge branch 'main' of https://github.com/s-and-p-team/kagenti-extens…
omerboehm Jun 20, 2026
b2f3611
merged load policy into setup keycloak
omerboehm Jun 20, 2026
9e2d0f5
Feat: Role-based scope gating for github-issue demo
omerboehm Jun 24, 2026
40f2e58
Feat: Role-based scope gating for github-issue demo - addressing code…
omerboehm Jun 24, 2026
a20a645
Feat: Role-based scope gating for github-issue demo - addressing
omerboehm Jun 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion authbridge/demos/github-issue/aiac/.gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ aiac.env
aiac_agent/config/llm_conf.yaml

# Generated policy files — created at runtime by aiac_cli.py.
generated_configs/
config/

# Python virtual environment
venv/
Expand Down
12 changes: 7 additions & 5 deletions authbridge/demos/github-issue/aiac/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,10 +31,12 @@ help: ## Show this menu (default)
$(MAKEFILE_LIST)
@printf "\nVariables:\n"
@printf " \033[36m%-20s\033[0m %s\n" "POLICY" "policy file to apply (default: policies/regular_policy.txt)"
@printf " \033[36m%-20s\033[0m %s\n" "RBAC_CONFIG" "RBAC config file (default: rbac/config.yaml)"
@printf " \033[36m%-20s\033[0m %s\n" "PYTHON" "Python interpreter (default: kagenti-extensions/.venv/bin/python)"
@printf "\nPrerequisites: uv, Keycloak running, aiac.env and llm_conf.yaml configured.\n\n"

POLICY ?= policies/regular_policy.txt
RBAC_CONFIG ?= rbac/config.yaml

# Resolve the venv relative to this Makefile, regardless of where make is invoked.
MAKEFILE_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
Expand Down Expand Up @@ -81,28 +83,28 @@ preflight: ## Verify prerequisites (uv, venv, aiac.env, llm_conf.yaml, Keycloak

setup: preflight ## Provision Keycloak realm with clients, roles, and users
@echo "[*] Provisioning Keycloak realm ..."
$(PYTHON) ../setup_keycloak.py -rbac config.yaml
$(PYTHON) ../setup_keycloak.py -rbac $(RBAC_CONFIG)
@echo "[✓] Keycloak realm provisioned."

# ---------- Apply policy ----------

apply-policy: preflight ## Generate + apply POLICY (default: policies/regular_policy.txt) to Keycloak
@echo "[*] Running AIAC full pipeline: $(POLICY)"
$(PYTHON) aiac_cli.py --yes $(POLICY)
$(PYTHON) aiac_cli.py $(POLICY)

apply-permissive: POLICY = policies/permissive_policy.txt
apply-permissive: apply-policy ## Generate + apply the permissive policy (grants Sales access)

# ---------- Show result ----------

show-result: preflight ## Show active composite-role mappings in Keycloak (verify applied policy)
$(PYTHON) scripts/show-result.py
$(PYTHON) scripts/show-result.py --config-path ../$(RBAC_CONFIG)

# ---------- Reset ----------

reset: preflight ## Wipe generated configs and re-provision the realm from scratch
@echo "[*] Removing generated configs ..."
@rm -f generated_configs/*.yaml
@rm -f config/*.yaml
@echo "[*] Re-provisioning Keycloak realm ..."
$(PYTHON) ../setup_keycloak.py -rbac config.yaml
$(PYTHON) ../setup_keycloak.py -rbac $(RBAC_CONFIG)
@echo "[✓] Reset complete."
9 changes: 4 additions & 5 deletions authbridge/demos/github-issue/aiac/aiac_cli.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,12 +149,11 @@ def run_full_pipeline(policy_text_file: str, policy_name: str | None, yes: bool
print_info(f"Policy name: {policy_name}")
print()

generated_configs_dir = script_dir / "generated_configs"
generated_configs_dir = script_dir / "config"
generated_configs_dir.mkdir(exist_ok=True)

config_file = generated_configs_dir / f"{policy_name}_config.yaml"
policy_file = generated_configs_dir / f"{policy_name}_policy.yaml"
main_config = "config.yaml"

realm_name = os.getenv("REALM_NAME", "demo")
keycloak_url = os.getenv("KEYCLOAK_URL")
Expand Down Expand Up @@ -212,7 +211,7 @@ def run_full_pipeline(policy_text_file: str, policy_name: str | None, yes: bool
realm_name=realm_name,
user_realm_name="master",
)
delete_access_control_policy(admin, realm_name, script_dir / main_config)
delete_access_control_policy(admin, realm_name, config_file=config_file)
print_success("Old rules removed successfully")
print()

Expand All @@ -226,8 +225,8 @@ def run_full_pipeline(policy_text_file: str, policy_name: str | None, yes: bool
print_success(f"Policy '{policy_name}' has been successfully updated in Keycloak")
print()
print_info("Generated files:")
print(f" - Configuration: generated_configs/{config_file.name}")
print(f" - Rules: generated_configs/{policy_file.name}")
print(f" - Configuration: {config_file}")
print(f" - Rules: {policy_file}")

except Exception as e:
print_error(f"An error occurred: {e}")
Expand Down
18 changes: 16 additions & 2 deletions authbridge/demos/github-issue/aiac/scripts/show-result.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
Run via: make show-result
"""

import argparse
import os
import sys
from pathlib import Path
Expand Down Expand Up @@ -46,6 +47,15 @@ def section(title: str) -> None:


def main() -> None:
parser = argparse.ArgumentParser(description="Display composite-role mappings currently active in Keycloak")
parser.add_argument(
"--config-path",
type=Path,
required=True,
help="Path to the RBAC configuration YAML file",
)
args = parser.parse_args()
Comment thread
coderabbitai[bot] marked this conversation as resolved.

try:
admin = KeycloakAdmin(
server_url=KEYCLOAK_URL,
Expand All @@ -58,7 +68,11 @@ def main() -> None:
print(f"{RED}ERROR: Could not connect to Keycloak at {KEYCLOAK_URL}: {e}{RESET}")
sys.exit(1)

config_path = AIAC_DIR / "config.yaml"
config_path = args.config_path
if not config_path.exists():
print(f"{RED}ERROR: Config file not found: {config_path}{RESET}")
sys.exit(1)

with open(config_path) as f:
config = yaml.safe_load(f)

Expand All @@ -85,7 +99,7 @@ def main() -> None:
name = c.get("name", "?")
print(f" {GREEN}✓{RESET} {container}.{name}")

gen_dir = AIAC_DIR / "generated_configs"
gen_dir = AIAC_DIR / "config"
policy_files = list(gen_dir.glob("*_policy.yaml")) if gen_dir.exists() else []
if policy_files:
latest = max(policy_files, key=lambda p: p.stat().st_mtime_ns)
Expand Down
39 changes: 20 additions & 19 deletions authbridge/demos/github-issue/demo-aiac.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -378,7 +378,7 @@ REALM_NAME=kagenti
Run the setup script to create the demo realm with clients, roles, and users:

```bash
python setup_keycloak.py -rbac config.yaml
python setup_keycloak.py -rbac rbac/config.yaml
```

Open bash inside the test client pod
Expand Down Expand Up @@ -560,26 +560,26 @@ python aiac_cli.py policies/regular_policy.txt
```

Review generated files:
- Configuration: generated_configs/regular_policy_config.yaml
- Rules: generated_configs/regular_policy_policy.yaml
- Configuration: config/regular_policy_config.yaml
- Rules: config/regular_policy_policy.yaml


Verify results
```bash
echo "1. Developer has github-full-access:"
yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-full-access")' generated_configs/regular_policy_policy.yaml
yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-full-access")' config/regular_policy_policy.yaml

echo -e "\n2. Developer has github-tool-aud:"
yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-tool-aud")' generated_configs/regular_policy_policy.yaml
yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-tool-aud")' config/regular_policy_policy.yaml

echo -e "\n3. Tech-support has github-tool-aud:"
yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-tool-aud")' generated_configs/regular_policy_policy.yaml
yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-tool-aud")' config/regular_policy_policy.yaml

echo -e "\n4. Tech-support does NOT have github-full-access (should be empty):"
yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-full-access")' generated_configs/regular_policy_policy.yaml
yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-full-access")' config/regular_policy_policy.yaml

echo -e "\n5. Sales does NOT exist in policy (should be null):"
yq '.policy.sales' generated_configs/regular_policy_policy.yaml
yq '.policy.sales' config/regular_policy_policy.yaml
```
Expected output :
```bash
Expand Down Expand Up @@ -641,7 +641,7 @@ echo "Client ID: $CLIENT_ID Secret length: ${#CLIENT_SECRET}"


# step 2 - run AIAC using regualr policy
# python AIAC.py policy/regular_policy.txt
# python aiac_cli.py policies/regular_policy.txt
# users will be configured acording to the 'regular' policy
#ALICE (Developer) can list issues in kagenti/kagenti repo
#ALICE can also list issues in omerboehm/intro2c repo (because she is a DEVELOPER and has full access)
Expand Down Expand Up @@ -791,26 +791,26 @@ Apply the updated policy
python aiac_cli.py policies/permissive_policy.txt
```
Review generated files:
- Configuration: generated_configs/permissive_policy_config.yaml
- Rules: generated_configs/permissive_policy_policy.yaml
- Configuration: config/permissive_policy_config.yaml
- Rules: config/permissive_policy_policy.yaml


Verify results
```bash
echo "1. Developer has github-full-access:"
yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-full-access")' generated_configs/permissive_policy_policy.yaml
yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-full-access")' config/permissive_policy_policy.yaml

echo -e "\n2. Developer has github-tool-aud:"
yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-tool-aud")' generated_configs/permissive_policy_policy.yaml
yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-tool-aud")' config/permissive_policy_policy.yaml

echo -e "\n3. Tech-support has github-tool-aud:"
yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-tool-aud")' generated_configs/permissive_policy_policy.yaml
yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-tool-aud")' config/permissive_policy_policy.yaml

echo -e "\n4. Tech-support does NOT have github-full-access (should be empty):"
yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-full-access")' generated_configs/permissive_policy_policy.yaml
yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-full-access")' config/permissive_policy_policy.yaml

echo -e "\n5. Sales is now just like Tech-support (\"Other personnel\"):"
yq '.policy.sales[] | select(.client == "github-tool" and .role == "github-tool-aud")' generated_configs/permissive_policy_policy.yaml
yq '.policy.sales[] | select(.client == "github-tool" and .role == "github-tool-aud")' config/permissive_policy_policy.yaml
```
Expected output :
```txt
Expand All @@ -831,17 +831,18 @@ role: github-tool-aud
5. Sales is now just like Tech-support ("Other personnel"):
client: github-tool
role: github-tool-aud

```


### Step 17: Reset Realm (Optional)

To clean up and start fresh:

```bash
cd demos/github-issue/
# delete generated policies
rm -f generated_configs/*.yaml
rm -f aiac/config/*.yaml

# re-provision the realm
python setup_keycloak.py -rbac config.yaml
python setup_keycloak.py -rbac rbac/config.yaml
Comment on lines 841 to +847

@coderabbitai coderabbitai Bot Jun 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Reset instructions use an inconsistent repo path.

Earlier steps use authbridge/demos/github-issue/..., but Step 17 switches to cd demos/github-issue/. From repo root that likely lands in the wrong directory, so the cleanup and reprovision commands won't work as written.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@authbridge/demos/github-issue/demo-aiac.md` around lines 841 - 847, The reset
step uses a repo path that is inconsistent with the rest of the demo
instructions, so update the Step 17 commands to use the same authenticated
repo-relative path as the earlier steps. Make the directory change in the reset
sequence match the `authbridge/demos/github-issue` location used elsewhere in
`demo-aiac.md`, and keep the cleanup and `setup_keycloak.py` reprovision
commands under that corrected path so they run from the intended directory.

```
Loading
Loading