12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
|
# File 'lib/legion/llm/pipeline/steps/rbac.rb', line 12
def step_rbac
start_time = Time.now
unless defined?(::Legion::Rbac)
if fleet_caller?
msg = 'RBAC unavailable: fleet callers require RBAC enforcement (fail-closed)'
log.error("[llm][rbac] fleet_blocked request_id=#{@request.id} reason=rbac_unavailable")
record_rbac_audit(:failure, msg, start_time)
record_rbac_timeline("denied: #{msg}")
raise Legion::LLM::PipelineError.new("403 Forbidden: #{msg}", step: :rbac)
end
@warnings << 'RBAC unavailable, permitting request without enforcement'
log.info("[llm][rbac] unavailable request_id=#{@request.id} action=permit_without_enforcement")
record_rbac_audit(:success, 'permitted (rbac unavailable)', start_time)
record_rbac_timeline('permitted (rbac unavailable)')
return
end
begin
principal = build_rbac_principal
caller_id =
log.info("[llm][rbac] authorize request_id=#{@request.id} caller=#{caller_id}")
::Legion::Rbac.authorize!(principal: principal, action: :use, resource: 'llm/pipeline')
log.info("[llm][rbac] permitted request_id=#{@request.id} caller=#{caller_id}")
record_rbac_audit(:success, "permitted caller=#{caller_id}", start_time)
record_rbac_timeline("permitted caller=#{caller_id}")
rescue ::Legion::Rbac::AccessDenied => e
log.warn("[llm][rbac] denied request_id=#{@request.id} error=#{e.message}")
record_rbac_audit(:failure, e.message, start_time)
record_rbac_timeline("denied: #{e.message}")
handle_exception(e, level: :warn, operation: 'llm.pipeline.steps.rbac.denied', request_id: @request.id)
raise Legion::LLM::PipelineError.new("403 Forbidden: #{e.message}", step: :rbac)
rescue StandardError => e
log.error("[llm][rbac] failed request_id=#{@request.id} error=#{e.message}")
record_rbac_audit(:failure, "error: #{e.message}", start_time)
record_rbac_timeline("error: #{e.message}")
handle_exception(e, level: :error, operation: 'llm.pipeline.steps.rbac', request_id: @request.id)
raise Legion::LLM::PipelineError.new("rbac error: #{e.message}", step: :rbac)
end
end
|