Harden Little Bull Premium workspace controls#3010
Harden Little Bull Premium workspace controls#3010JOTAAAA12 wants to merge 16 commits intoHKUDS:mainfrom
Conversation
Require enterprise tokens for governed core API access, enforce real token secrets and bootstrap gating, scope approval decisions, contain unbacked workspaces, and reflect permissions/workspace state in the Little Bull UI. Validation: git diff --check; uv run ruff check lightrag/api/utils_api.py lightrag/api/lightrag_server.py lightrag_enterprise tests_enterprise; ./scripts/test.sh tests_enterprise; cd lightrag_webui && bunx tsc --noEmit; cd lightrag_webui && bun test src/api/lightrag.test.ts src/fixtures/littleBullKnowledge.test.ts; cd lightrag_webui && bun run build.
|
Local validation/status update from Codex:
|
|
CI status update: I marked the PR ready for review so
This appears to require maintainer approval for Actions on this fork PR. Local validation evidence remains in the previous comment and PR body. Product READY is still not declared. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3c3e530f6d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if enterprise_auth_state == ENTERPRISE_AUTH_UNAVAILABLE: | ||
| raise HTTPException( | ||
| status_code=status.HTTP_503_SERVICE_UNAVAILABLE, | ||
| detail="Little Bull enterprise authentication is unavailable.", | ||
| ) |
There was a problem hiding this comment.
When LIGHTRAG_SYSTEM_DATABASE_URL is not configured (common non-enterprise setup), get_enterprise_auth_state() can resolve to ENTERPRISE_AUTH_UNAVAILABLE because enterprise runtime defaults require a control-plane DB, and this branch immediately returns HTTP 503 for any route using get_combined_auth_dependency. That turns previously functional core endpoints (for API key/JWT/guest flows) into service-unavailable responses instead of using the existing auth path.
Useful? React with 👍 / 👎.
| element={isAuthenticated && !isGuestMode ? <Navigate to="/little-bull" replace /> : <Navigate to="/login" replace />} | ||
| /> |
There was a problem hiding this comment.
The router now treats isGuestMode the same as unauthenticated and redirects / to /login, but LoginPage still auto-authenticates guest users (when auth is disabled) and navigates back to /; this creates a redirect loop in guest mode and blocks UI access for deployments that rely on auth_mode: disabled guest tokens.
Useful? React with 👍 / 👎.
|
CI retry update: After the approval note, I pushed an empty commit (
I cannot rerun/approve these Actions from my account ( |
|
Local workflow-equivalent update: Since upstream Actions are still
I also reran affected gates after the formatting commit:
Pushed formatting commit |
1 participant
Little Bull Premium Phase 21 PR Notes
Status date: 2026-05-01
This note summarizes commit
40779b98 Fix Little Bull permissions and tri-bank smoke.It contains no secrets, tokens, passwords,
.envvalues or connection strings.Summary
little_bull.documents.read, scoped workspace choices can be derived from the principal, and taxonomy for classified upload remains gated bylittle_bull.areas.read.Backend / Control Plane
NEO4J_WORKSPACE,QDRANT_WORKSPACEorPOSTGRES_WORKSPACEoverride was set.Frontend
LittleBullPreviewnow loads groups/subgroups for uploads and blocks file selection until classification is complete.workspace_ids.littleBullWorkspace.tscentralizes permission and upload state rules for direct unit testing.Validation Evidence
uv run ruff check lightrag_enterprise tests_enterprise lightrag/api/lightrag_server.py tests/test_interactive_setup/_helpers.pypython -m lightrag_enterprise.system.migrate./scripts/test.sh tests_enterprise -q: 184 passed, 4 skipped../scripts/test.sh tests -q: 794 passed, 32 skipped.cd lightrag_webui && bun test: 21 passed.cd lightrag_webui && bunx tsc --noEmitcd lightrag_webui && bun run lintcd lightrag_webui && bun run test:visual: 3 passed.cd lightrag_webui && bun run buildnode /Users/joao_tourinho/Documents/specops-tooling-os/packages/cli/dist/index.js validate: 0 issues.node /Users/joao_tourinho/Documents/specops-tooling-os/packages/cli/dist/index.js eval: 10 passed, 0 failed.git diff --checkSmoke Evidence
Additive current-worktree smoke on temporary server
127.0.0.1:9631:phase21_smoke_820a9f72e3b4doc-1588f7b35aed62f7a69230c53c9b711aStrict tri-bank smoke on temporary server
127.0.0.1:9632:phase21_tribank_44657da3ed86doc-974a377549c90fa3d2434ec663c8b1f4Rollback
LITTLE_BULL_GRAPH_V2_ENABLEDLITTLE_BULL_QDRANT_DATA_PLANE_ENABLEDLITTLE_BULL_OBSIDIAN_WORKSPACE_ENABLEDREADY Status
Do not declare READY from this note alone.
READY still requires final release review, explicit cleanup decision if cleanup is desired, and all production release gates.