12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
|
# File 'lib/legion/llm/pipeline/steps/rbac.rb', line 12
def step_rbac
start_time = Time.now
unless defined?(::Legion::Rbac)
if fleet_caller? || !fail_open_permitted?
msg = '503: RBAC unavailable — request denied ' \
"(fleet=#{fleet_caller?}, fail_open=#{fail_open_permitted?})"
log.error("[llm][rbac] blocked request_id=#{@request.id} reason=rbac_unavailable " \
"fleet=#{fleet_caller?} fail_open=#{fail_open_permitted?}")
record_rbac_audit(:failure, msg, start_time)
record_rbac_timeline("denied: #{msg}")
raise Legion::LLM::PipelineError.new(msg, step: :rbac)
end
log.warn('[llm][rbac] RBAC unavailable, permitting request (fail_open enabled) ' \
"request_id=#{@request.id}")
@warnings << 'RBAC unavailable, permitting request (fail_open enabled)'
record_rbac_audit(:success, 'permitted (rbac unavailable, fail_open enabled)', start_time)
record_rbac_timeline('permitted (rbac unavailable, fail_open enabled)')
return
end
begin
principal = build_rbac_principal
caller_id =
log.info("[llm][rbac] authorize request_id=#{@request.id} caller=#{caller_id}")
::Legion::Rbac.authorize!(principal: principal, action: :use, resource: 'llm/pipeline')
log.info("[llm][rbac] permitted request_id=#{@request.id} caller=#{caller_id}")
record_rbac_audit(:success, "permitted caller=#{caller_id}", start_time)
record_rbac_timeline("permitted caller=#{caller_id}")
rescue ::Legion::Rbac::AccessDenied => e
log.warn("[llm][rbac] denied request_id=#{@request.id} error=#{e.message}")
record_rbac_audit(:failure, e.message, start_time)
record_rbac_timeline("denied: #{e.message}")
handle_exception(e, level: :warn, operation: 'llm.pipeline.steps.rbac.denied', request_id: @request.id)
raise Legion::LLM::PipelineError.new("403 Forbidden: #{e.message}", step: :rbac)
rescue StandardError => e
log.error("[llm][rbac] failed request_id=#{@request.id} error=#{e.message}")
record_rbac_audit(:failure, "error: #{e.message}", start_time)
record_rbac_timeline("error: #{e.message}")
handle_exception(e, level: :error, operation: 'llm.pipeline.steps.rbac', request_id: @request.id)
raise Legion::LLM::PipelineError.new("rbac error: #{e.message}", step: :rbac)
end
end
|