Skip to content

feat(models): govern provider configuration paths - #14327

Merged
erichare merged 4 commits into
feat/le-1953-approved-provider-policyfrom
feat/le-1956-provider-configuration-policy
Jul 31, 2026
Merged

feat(models): govern provider configuration paths#14327
erichare merged 4 commits into
feat/le-1953-approved-provider-policyfrom
feat/le-1956-provider-configuration-policy

Conversation

@erichare

@erichare erichare commented Jul 29, 2026

Copy link
Copy Markdown
Member

Summary

  • reject blocked providers during credential validation, save, and rename
  • filter assistant/provider discovery and configuration before catalog loaders execute
  • enforce the same CONFIGURE policy across add, build, configure, propose, search, describe, and run-flow injection paths
  • keep denial messages generic and preserve default allow-all behavior

Stack

Jira

Test plan

  • 71 lfx flow-builder tests
  • 59 focused assistant/provider/run-tool tests (plus 1 existing xfail)
  • 16 model-policy API tests
  • Ruff, pre-commit, code review, and defensive authorization review

@coderabbitai

coderabbitai Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)
  • release-.*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 326daca1-f7e3-4ea5-a471-91ffa7a77476

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added enhancement New feature or request and removed enhancement New feature or request labels Jul 29, 2026
@erichare
erichare force-pushed the feat/le-1955-provider-runtime-policy branch from 34a9ff7 to 2eefb24 Compare July 29, 2026 23:37
@erichare
erichare force-pushed the feat/le-1956-provider-configuration-policy branch from c191921 to 1a665f8 Compare July 29, 2026 23:37
@github-actions github-actions Bot added enhancement New feature or request and removed enhancement New feature or request labels Jul 29, 2026
@erichare
erichare force-pushed the feat/le-1956-provider-configuration-policy branch from 1a665f8 to ceca644 Compare July 29, 2026 23:46
@erichare
erichare force-pushed the feat/le-1955-provider-runtime-policy branch from 2eefb24 to 7197067 Compare July 29, 2026 23:46
@github-actions github-actions Bot added enhancement New feature or request and removed enhancement New feature or request labels Jul 29, 2026
Base automatically changed from feat/le-1955-provider-runtime-policy to feat/le-1953-approved-provider-policy July 31, 2026 19:28
@erichare
erichare marked this pull request as ready for review July 31, 2026 19:29
@erichare
erichare merged commit 2092dab into feat/le-1953-approved-provider-policy Jul 31, 2026
12 of 16 checks passed
@erichare
erichare deleted the feat/le-1956-provider-configuration-policy branch July 31, 2026 19:29
@github-actions github-actions Bot added enhancement New feature or request and removed enhancement New feature or request labels Jul 31, 2026
@github-actions

Copy link
Copy Markdown
Contributor

✅ Test Coverage Advisor

No source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉

Advisory check only — never blocks merge.

erichare added a commit that referenced this pull request Jul 31, 2026
* feat(models): establish provider governance foundation

* fix(models): harden provider governance foundation

* test(models): use canonical provider ids in policy mocks

* feat(models): add approved provider policy store

* feat(models): enforce provider policy on reads (#14325)

* feat(models): fail closed on denied provider runtime (#14326)

* feat(models): enforce provider policy on reads

* feat(models): fail closed on denied provider runtime

* feat(models): govern provider configuration paths (#14327)

* feat(models): enforce provider policy on reads

* feat(models): fail closed on denied provider runtime

* feat(models): govern provider configuration paths

* fix(models): resolve provider IDs in policy test

* fix(models): address provider policy review

* fix(models): reconcile provider policy with release head
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant