oc_chat.registry.auth.roles Namespace Reference

Classes
class	RoleGuard

Functions
bool	_is_system_operation (str operation_type)

Variables
	SlotKind = str
	ALL_SLOT_KINDS = frozenset({"operator", "orchestrator", "worker"})
tuple	SYSTEM_OPERATION_PREFIXES = ("migrate.", "heartbeat.")
	SYSTEM_OPERATION_TYPES = frozenset({"doctor.diagnose"})
dict	ROLE_ALLOWSETS
tuple	PREFIX_ALLOWSETS

Detailed Description

Runtime role guard for registry operations.

Purpose
-------
Map registry operation namespaces to the actor slot kinds that may author
them.

Responsibilities
----------------
- Keep the allow table in one auditable location.
- Raise typed role errors before any operation-log mutation starts.
- Provide an explicit system-actor bypass for enumerated internal rows.

Diagnostics
-----------
Domain: OC_CHAT.MAIN
Levels:
    L2 - lifecycle events
    L3 - semantic details
    L4 - deep tracing

Contracts
---------
- A role mismatch is not an auth failure and does not write ``auth_events``.
- Unknown test/private operation namespaces remain compatibility-allowed.

Dependencies
------------
- oc_chat.registry.errors (ActorRoleMismatchError raised on a role mismatch)
- oc_diagnostics (structured debug logging via _dbg)

Function Documentation

_is_system_operation()

bool oc_chat.registry.auth.roles._is_system_operation ( str operation_type )

protected

Definition at line 119 of file roles.py.

Here is the caller graph for this function:

Variable Documentation

ALL_SLOT_KINDS

oc_chat.registry.auth.roles.ALL_SLOT_KINDS = frozenset({"operator", "orchestrator", "worker"})

Definition at line 49 of file roles.py.

PREFIX_ALLOWSETS

tuple oc_chat.registry.auth.roles.PREFIX_ALLOWSETS

Initial value:

=  (
    ("plan.", frozenset({"operator", "orchestrator", "worker"})),
    ("queue.", frozenset({"operator", "orchestrator"})),
    ("roadmap_", frozenset({"operator", "orchestrator"})),
    ("roadmap.", frozenset({"operator", "orchestrator"})),
    ("round.", frozenset({"orchestrator"})),
    ("migrate.", frozenset({"operator"})),
    ("db.", frozenset({"operator"})),
    ("doctor.", frozenset({"operator"})),
    ("_test.", ALL_SLOT_KINDS),
)

Definition at line 70 of file roles.py.

ROLE_ALLOWSETS

dict oc_chat.registry.auth.roles.ROLE_ALLOWSETS

Initial value:

=  {
    "auth.register_key": frozenset({"operator"}),
    "auth.rotate_start": frozenset({"operator"}),
    "auth.rotate_finalize": frozenset({"operator"}),
    "auth.reset": frozenset({"operator"}),
    "audit.override": frozenset({"operator", "orchestrator"}),
    "audit.verify": frozenset({"operator", "orchestrator"}),
    "db.archive_log.start": frozenset({"operator"}),
    "db.archive_log.complete": frozenset({"operator"}),
    "doctor.repair": frozenset({"operator"}),
    "handover.accept": frozenset({"orchestrator", "operator"}),
    "handover.initiate": frozenset({"orchestrator", "operator"}),
    "handover.timeout": frozenset({"operator"}),
    "role.handover.complete": frozenset({"orchestrator", "operator"}),
    "role.handover.start": frozenset({"orchestrator", "operator"}),
}

Definition at line 53 of file roles.py.

SlotKind

oc_chat.registry.auth.roles.SlotKind = str

Definition at line 47 of file roles.py.

SYSTEM_OPERATION_PREFIXES

tuple oc_chat.registry.auth.roles.SYSTEM_OPERATION_PREFIXES = ("migrate.", "heartbeat.")

Definition at line 50 of file roles.py.

SYSTEM_OPERATION_TYPES

oc_chat.registry.auth.roles.SYSTEM_OPERATION_TYPES = frozenset({"doctor.diagnose"})

Definition at line 51 of file roles.py.