openclaw
eb4a3adb3f
- Add agent context isolation API, RBAC, resolver, audit, dashboard modules - Deploy context isolation policy config - Fix OpenAPI workspace permissions (chown aiman:gitops) - Update ChatGPT actions API with new internals - Add CMD files for group/owner isolation and permission fix - Archive completed command files
56 lines
1.6 KiB
Python
56 lines
1.6 KiB
Python
"""RBAC binding for group main agents and owner agents."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import asdict, dataclass
|
|
from typing import Any
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class AgentRoutingDecision:
|
|
user_id: str
|
|
group_id: str
|
|
role: str
|
|
agent_id: str
|
|
scope: str
|
|
allowed: bool
|
|
reason: str
|
|
|
|
def to_dict(self) -> dict[str, Any]:
|
|
return asdict(self)
|
|
|
|
|
|
class AgentContextRBAC:
|
|
"""Routes users to group agents and owners to dedicated owner agents."""
|
|
|
|
VALID_ROLES = {"user", "group_admin", "owner"}
|
|
|
|
def route(self, user_id: str, group_id: str | None, role: str) -> AgentRoutingDecision:
|
|
if role not in self.VALID_ROLES:
|
|
return AgentRoutingDecision(user_id, group_id or "", role, "", "none", False, "unknown_role")
|
|
if role == "owner":
|
|
return AgentRoutingDecision(
|
|
user_id=user_id,
|
|
group_id=group_id or "global",
|
|
role=role,
|
|
agent_id=f"owner-agent:{user_id}",
|
|
scope="global",
|
|
allowed=True,
|
|
reason="owner_dedicated_agent",
|
|
)
|
|
if not group_id:
|
|
return AgentRoutingDecision(user_id, "", role, "", "none", False, "group_required")
|
|
scope = "group" if role == "group_admin" else "self"
|
|
return AgentRoutingDecision(
|
|
user_id=user_id,
|
|
group_id=group_id,
|
|
role=role,
|
|
agent_id=f"group-main-agent:{group_id}",
|
|
scope=scope,
|
|
allowed=True,
|
|
reason="group_agent_routing",
|
|
)
|
|
|
|
|
|
__all__ = ["AgentRoutingDecision", "AgentContextRBAC"]
|