GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix: Denial by default to all resources when no permissions set by jyejare · Pull Request #5663 · feast-dev/feast

fix: Denial by default to all resources when no permissions set #5663

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ntkathole merged 2 commits into feast-dev:master from jyejare:objects_default_deniel
Jan 13, 2026

Uh oh!

There was an error while loading. Please reload this page.
Merged

fix: Denial by default to all resources when no permissions set #5663

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
606f98d
Denial by default to all resources when no permissions set
jyejare Oct 13, 2025
11e2026
Tests are updated to match the new behavior
jyejare Dec 15, 2025
File filter
Filter by extension
Clear filters
Conversations
Failed to load comments.
Loading

Uh oh!

There was an error while loading. Please reload this page.
Jump to
Jump to file
Failed to load files.
Loading

Uh oh!

There was an error while loading. Please reload this page.
Diff view
Diff view

There are no files selected for viewing

49 changes: 37 additions & 12 deletions 49 sdk/python/feast/permissions/enforcer.py
Show comments
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,9 +43,9 @@ def enforce_policy(
# If no permissions are defined, deny access to all resources
# This is a security measure to prevent unauthorized access
logger.warning("No permissions defined - denying access to all resources")
if not filter_only:
raise FeastPermissionError("No permissions defined - access denied")
return []
raise FeastPermissionError(
Comment thread
jyejare marked this conversation as resolved.
Resolved

Uh oh!

There was an error while loading. Please reload this page.
"Permissions are not defined - access denied for all resources"
)

_permitted_resources: list[FeastObject] = []
for resource in resources:
Expand All @@ -71,17 +71,42 @@ def enforce_policy(

if evaluator.is_decided():
grant, explanations = evaluator.grant()
if not grant and not filter_only:
if not grant:
if filter_only and p.name_patterns:
continue
logger.error(f"Permission denied: {','.join(explanations)}")
raise FeastPermissionError(",".join(explanations))
if grant:
logger.debug(
f"Permission granted for {type(resource).__name__}:{resource.name}"
)
_permitted_resources.append(resource)
logger.debug(
f"Permission granted for {type(resource).__name__}:{resource.name}"
)
_permitted_resources.append(resource)
break
Comment thread
jyejare marked this conversation as resolved.
Resolved

Uh oh!

There was an error while loading. Please reload this page.
else:
message = f"No permissions defined to manage {actions} on {type(resource)}/{resource.name}."
logger.exception(f"**PERMISSION NOT GRANTED**: {message}")
raise FeastPermissionError(message)
if not filter_only:
message = f"No permissions defined to manage {actions} on {type(resource)}/{resource.name}."
logger.exception(f"**PERMISSION NOT GRANTED**: {message}")
raise FeastPermissionError(message)
else:
# filter_only=True: Check if there are permissions for this resource type
resource_type_permissions = [
p
for p in permissions
if any(isinstance(resource, t) for t in p.types) # type: ignore
]
if not resource_type_permissions:
# No permissions exist for this resource type - should raise error
message = f"No permissions defined to manage {actions} on {type(resource)}/{resource.name}."
logger.exception(f"**PERMISSION NOT GRANTED**: {message}")
Comment thread
jyejare marked this conversation as resolved.
Resolved

Uh oh!

There was an error while loading. Please reload this page.
raise FeastPermissionError(message)
elif not any(p.name_patterns for p in resource_type_permissions):
# Permissions exist for this resource type but no name_patterns - should raise error
message = f"No permissions defined to manage {actions} on {type(resource)}/{resource.name}."
logger.exception(f"**PERMISSION NOT GRANTED**: {message}")
raise FeastPermissionError(message)
else:
# Permissions exist for this resource type with name_patterns - filter out this resource
logger.debug(
f"Filtering out {type(resource).__name__}:{resource.name} - no matching permissions"
)
continue
return _permitted_resources
30 changes: 30 additions & 0 deletions 30 sdk/python/tests/unit/permissions/auth/server/test_auth_registry_server.py
Show comments
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,11 @@ def _test_get_historical_features(client_fs: FeatureStore):


def _test_get_entity(client_fs: FeatureStore, permissions: list[Permission]):
if _is_auth_enabled(client_fs) and len(permissions) == 0:
with pytest.raises(FeastPermissionError):
client_fs.get_entity("driver")
return

if not _is_auth_enabled(client_fs) or _is_permission_enabled(
client_fs, permissions, read_entities_perm
):
Expand All @@ -156,6 +161,18 @@ def _test_get_entity(client_fs: FeatureStore, permissions: list[Permission]):


def _test_list_entities(client_fs: FeatureStore, permissions: list[Permission]):
if _is_auth_enabled(client_fs) and len(permissions) == 0:
with pytest.raises(FeastPermissionError):
client_fs.list_entities()
return

if _is_auth_enabled(client_fs) and _permissions_exist_in_permission_list(
[invalid_list_entities_perm], permissions
):
with pytest.raises(FeastPermissionError):
client_fs.list_entities()
return

entities = client_fs.list_entities()

if not _is_auth_enabled(client_fs) or _is_permission_enabled(
Expand Down Expand Up @@ -183,6 +200,10 @@ def _test_list_permissions(
with pytest.raises(Exception):
client_fs.list_permissions()
return []
elif _is_auth_enabled(client_fs) and len(applied_permissions) == 0:
with pytest.raises(FeastPermissionError):
client_fs.list_permissions()
return []
else:
permissions = client_fs.list_permissions()

Expand Down Expand Up @@ -229,6 +250,11 @@ def _is_auth_enabled(client_fs: FeatureStore) -> bool:


def _test_get_fv(client_fs: FeatureStore, permissions: list[Permission]):
if _is_auth_enabled(client_fs) and len(permissions) == 0:
with pytest.raises(FeastPermissionError):
client_fs.get_feature_view("driver_hourly_stats")
return

if not _is_auth_enabled(client_fs) or _is_permission_enabled(
client_fs, permissions, read_fv_perm
):
Expand All @@ -249,6 +275,10 @@ def _test_list_fvs(client_fs: FeatureStore, permissions: list[Permission]):
with pytest.raises(Exception):
client_fs.list_feature_views()
return []
elif _is_auth_enabled(client_fs) and len(permissions) == 0:
with pytest.raises(FeastPermissionError):
client_fs.list_feature_views()
return []
else:
fvs = client_fs.list_feature_views()
for fv in fvs:
Expand Down
12 changes: 6 additions & 6 deletions 12 sdk/python/tests/unit/permissions/test_security_manager.py
Show comments
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
@pytest.mark.parametrize(
"username, requested_actions, allowed, allowed_single, raise_error_in_assert, raise_error_in_permit, intra_communication_flag",
[
(None, [], False, [False, False], [True, True], False, False),
(None, [], False, [False, False], [True, True], True, False),
(None, [], True, [True, True], [False, False], False, True),
(
"r",
Expand All @@ -42,7 +42,7 @@
False,
[False, False],
[True, True],
False,
True,
False,
),
("r", [AuthzedAction.UPDATE], True, [True, True], [False, False], False, True),
Expand All @@ -52,7 +52,7 @@
False,
[False, False],
[True, True],
False,
True,
False,
),
(
Expand Down Expand Up @@ -116,7 +116,7 @@
False,
[False, False],
[True, True],
True,
False,
False,
),
(
Expand All @@ -134,7 +134,7 @@
False,
[False, True],
[True, False],
True,
False,
False,
),
(
Expand All @@ -152,7 +152,7 @@
False,
[False, False],
[True, True],
True,
False,
False,
),
(
Expand Down
Loading
Oops, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.