feat: Implement grant deletion provider api #524

konac-hamza · 2026-01-19T22:46:23Z

No description provided.

src/assignment/mod.rs

gtema · 2026-01-20T16:29:47Z

src/assignment/backend/sql/assignment/delete.rs

+        | AssignmentType::GroupProject
+        | AssignmentType::UserDomain
+        | AssignmentType::UserProject => {
+            db_assignment::Entity::delete_many()


all those fields are part of the composed PK. It is better to access it this way. Reason is that when some of the filter parameters here are wrong we may end up deleting what we should not

please use the delete_by_id here

gtema · 2026-01-20T16:47:00Z

src/assignment/types/assignment.rs

+#[derive(Builder, Clone, Debug, Deserialize, PartialEq, Serialize, Validate)]
+#[builder(build_fn(error = "BuilderError"))]
+#[builder(setter(strip_option, into))]
+pub struct AssignmentRevoke {


please implement the From for AssignmentRevoke. I think this is going to be more comfortable to use it this way (check the assignment and pass it down to the revoke), but honestly I doubt whether we need AssignmentRevoke at all (it's same except few optional fields) and we should just use the Assignment directly?

During implementation, I also had doubts about the necessity of AssignmentRevoke.
Then I realized that the AssignmentCreate struct is almost the same as Assignment.
So I kept the same approach for AssignmentRevoke but use Assignment directly look more clear. I will update PR accordingly

create/update is a slightly different usecase. Usually they look very similar, but have differences (i.e. some attributes are not updatable)

gtema · 2026-01-20T16:48:33Z

src/api/v3/role_assignment/project/user/role/revoke.rs

+
+    policy
+        .enforce(
+            "identity/project/user/role/check",


that is definitely wrong - check policy is pretty permissive while role assignment/revokation is intended to be used by admin/domain_manager only (similar to the grant policy). I would need to implement this policy first

gtema

after analysis of the python keystone I see few things that need to be addressed somehow (maybe consciously not implemented):

python code handles also the inherited deployment revocation automatically: https://opendev.org/openstack/keystone/src/branch/master/keystone/api/projects.py#L567 I do not like that personally, but the compatibility we may need to implement it the same way
python code returns 404 when the assignment was not existing. In the other providers we currently check for affected rows and raise not found when no rows were affected (https://opendev.org/openstack/keystone/src/branch/master/keystone/api/projects.py#L567).

gtema · 2026-01-22T11:25:46Z

src/api/v3/role_assignment/project/user/role/revoke.rs

+    ),
+    security(
+        ("X-Auth-Token" = [])),
+    tag="Role Assignment"


the openapi tag should match the one in the create assignment, it influences how endpoints are grouped

gtema · 2026-01-23T17:17:06Z

src/assignment/backend/sql/assignment/delete.rs

+        | AssignmentType::GroupProject
+        | AssignmentType::UserDomain
+        | AssignmentType::UserProject => {
+            db_assignment::Entity::delete_many()


please use the delete_by_id here

gtema · 2026-01-23T17:21:05Z

src/assignment/backend/sql/assignment/delete.rs

+    }
+
+    #[tokio::test]
+    async fn test_delete_inherited_not_found_returns_error() {


since the implementation does not really differentiate upon the inherited field this test makes no sense - mocks are the same

gtema · 2026-01-23T17:22:01Z

src/api/v3/role_assignment/project/user/role/revoke.rs

+//
+// SPDX-License-Identifier: Apache-2.0
+
+//! Project user role: delete


the new linter check will start complaining here. Please ensure docstrings have proper ending punctuation.

gtema · 2026-01-23T17:24:19Z

src/assignment/error.rs

    fn from(source: AssignmentDatabaseError) -> Self {
        match source {
+            AssignmentDatabaseError::AssignmentNotFound(msg) => {
+                AssignmentProviderError::AssignmentNotFound(msg)


this new error should be also handled in the stc/api/error - we do not want to return 500 to the user

Add policy to revoke role from user

Define AssignmentNotFound error type

src/assignment/error.rs

gtema

is coming close. Can you please also add an integration test (https://github.com/openstack-experimental/keystone/blob/main/tests/integration/assignment/grant.rs) to verify that the grant has been revoked and the assignment check after revoke confirms it is not there. In the separate change you could add more tests (revoking a grant that was not present, revoking inherited grant, etc)

gtema · 2026-01-27T09:49:43Z

src/api/v3/role_assignment/project/user/role/revoke.rs

+    tag="role_assignments"
+)]
+#[tracing::instrument(
+    name = "api::v3:project_user_role_revoke",


one ":" is missing

github-advanced-security bot found potential problems Jan 19, 2026

View reviewed changes

src/assignment/mod.rs Fixed Show fixed Hide fixed

src/assignment/mod.rs Fixed Show fixed Hide fixed

gtema reviewed Jan 20, 2026

View reviewed changes

konac-hamza force-pushed the feature/grant-deletion branch 2 times, most recently from 5f9d1f0 to 0f30fea Compare January 21, 2026 22:56

gtema requested changes Jan 22, 2026

View reviewed changes

konac-hamza force-pushed the feature/grant-deletion branch from 0f30fea to ac579ad Compare January 23, 2026 00:19

gtema requested changes Jan 23, 2026

View reviewed changes

konac-hamza added 5 commits January 26, 2026 23:53

feat: Implement grant deletion provider api

affa1e5

fix: Fix reference warning

5c416d9

fix: Use Assignment struct to obtain clean design

6456578

Add policy to revoke role from user

feat: Set inherited by inherited_to_projects

88764fd

Define AssignmentNotFound error type

fix: Fix issues by the reviews

5f480d9

konac-hamza force-pushed the feature/grant-deletion branch from ac579ad to 5f480d9 Compare January 26, 2026 21:26

github-advanced-security bot found potential problems Jan 26, 2026

View reviewed changes

src/assignment/error.rs Fixed Show fixed Hide fixed

src/assignment/error.rs Fixed Show fixed Hide fixed

fix: Fix Test issues

652df5f

gtema requested changes Jan 27, 2026

View reviewed changes

feat: Implement integration test for grant deletion

806e021

feat: Implement grant deletion provider api #524

Are you sure you want to change the base?

feat: Implement grant deletion provider api #524

Uh oh!

Conversation

konac-hamza commented Jan 19, 2026

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gtema left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

gtema left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants