Merge pull request #4820 from Agenta-AI/release/v0.104.3

[release] v0.104.3

Author: bekossy

api/AGENTS.md

@@ -39,6 +39,20 @@ OSS and EE relationship:
   - `ee.extend_app_schema(app)` for OpenAPI/security metadata.
 - EE is additive over OSS, not a separate API architecture.
 
+RBAC / access enforcement:
+
+- RBAC enforcement is an OSS feature and is always-on in both editions. The
+  permission vocabulary, default role catalog, and enforcement service live in
+  `api/oss/src/core/access/`. Handlers call `check_action_access(...)`
+  unconditionally; there is no edition gate around the check itself.
+- The only edition difference is the EE plan gate: in EE, `check_entitlements(Flag.RBAC)`
+  can grant allow-all when a plan is not RBAC-entitled. This is layered into the OSS
+  enforcement service via a function-local `is_ee()`-guarded import — OSS never imports
+  `ee.*` at module top.
+- Custom roles are an EE feature: `AGENTA_ACCESS_ROLES` / `AGENTA_ACCESS_ROLES_OVERLAY`
+  are parsed/applied in `api/ee/src/core/access/permissions/role_overrides.py` and
+  ignored in OSS (which enforces the code-default catalog).
+
 Primary references:
 - `api/entrypoints/routers.py`
 - `api/ee/src/main.py`

api/ee/databases/postgres/migrations/core/data_migrations/api_keys.py

@@ -8,7 +8,7 @@
 
 from oss.src.models.db_models import APIKeyDB
 from oss.src.models.db_models import ProjectDB
-from ee.src.models.extended.deprecated_models import DeprecatedAPIKeyDB
+from ee.databases.postgres.migrations.core.deprecated_models import DeprecatedAPIKeyDB
 
 
 BATCH_SIZE = 200

api/ee/databases/postgres/migrations/core/data_migrations/applications.py

@@ -7,7 +7,7 @@
 from sqlalchemy.future import select
 from sqlalchemy import delete, Connection, update, func
 
-from oss.src.models.deprecated_models import (  # type: ignore
+from oss.databases.postgres.migrations.core.deprecated_models import (  # type: ignore
     DeprecatedEvaluatorConfigDBwApp as DeprecatedEvaluatorConfigDB,
     DeprecatedAppDB,
 )

api/ee/databases/postgres/migrations/core/data_migrations/applications_workflow.py

@@ -10,9 +10,9 @@
 from sqlalchemy import func, text
 from sqlalchemy.ext.asyncio import AsyncConnection, create_async_engine
 
-from ee.src.models.db_models import WorkspaceMemberDB as WorkspaceMemberDBE
+from oss.src.models.db_models import WorkspaceMemberDB as WorkspaceMemberDBE
 from oss.src.models.db_models import ProjectDB as ProjectDBE
-from oss.src.models.deprecated_models import (
+from oss.databases.postgres.migrations.core.deprecated_models import (
     AppDB,
     AppVariantDB,
     AppVariantRevisionsDB,

api/ee/databases/postgres/migrations/core/data_migrations/default_environments.py

@@ -8,7 +8,7 @@
 from sqlalchemy.ext.asyncio import AsyncConnection, create_async_engine
 from sqlalchemy.future import select
 
-from ee.src.models.db_models import WorkspaceMemberDB as WorkspaceMemberDBE
+from oss.src.models.db_models import WorkspaceMemberDB as WorkspaceMemberDBE
 from oss.src.core.environments.dtos import (
     EnvironmentCreate,
     EnvironmentRevisionCommit,

api/ee/databases/postgres/migrations/core/data_migrations/demos.py

@@ -16,7 +16,7 @@
     ProjectDB,
     UserDB,
 )
-from ee.src.models.db_models import (
+from oss.src.models.db_models import (
     OrganizationMemberDB,
     WorkspaceMemberDB,
     ProjectMemberDB,

api/ee/databases/postgres/migrations/core/data_migrations/environments.py

@@ -12,7 +12,7 @@
 from sqlalchemy.ext.asyncio import AsyncConnection, create_async_engine
 
 from oss.src.models.db_models import ProjectDB as ProjectDBE
-from oss.src.models.deprecated_models import (
+from oss.databases.postgres.migrations.core.deprecated_models import (
     AppDB,
     AppVariantDB,
     AppVariantRevisionsDB,
@@ -36,7 +36,7 @@
     EnvironmentRevisionData,
 )
 from oss.src.core.shared.dtos import Reference
-from ee.src.models.db_models import WorkspaceMemberDB as WorkspaceMemberDBE
+from oss.src.models.db_models import WorkspaceMemberDB as WorkspaceMemberDBE
 
 
 # Define constants

api/ee/databases/postgres/migrations/core/data_migrations/evaluators.py

@@ -9,9 +9,9 @@
 from sqlalchemy import func
 from sqlalchemy.ext.asyncio import AsyncConnection, create_async_engine
 
-from ee.src.models.db_models import WorkspaceMemberDB as WorkspaceMemberDBE
+from oss.src.models.db_models import WorkspaceMemberDB as WorkspaceMemberDBE
 from oss.src.models.db_models import ProjectDB as ProjectDBE
-from oss.src.models.deprecated_models import EvaluatorConfigDB
+from oss.databases.postgres.migrations.core.deprecated_models import EvaluatorConfigDB
 from oss.src.dbs.postgres.workflows.dbes import (
     WorkflowArtifactDBE,
     WorkflowVariantDBE,
@@ -27,7 +27,7 @@
     SimpleEvaluatorFlags,
 )
 from oss.src.core.evaluators.utils import build_evaluator_data
-from oss.src.models.deprecated_models import (
+from oss.databases.postgres.migrations.core.deprecated_models import (
     DeprecatedAutoEvaluatorConfigDBwProject as DeprecatedEvaluatorConfigDBwProject,
 )
 from oss.src.core.workflows.service import WorkflowsService

api/ee/databases/postgres/migrations/core/data_migrations/export_records.py

@@ -2,8 +2,8 @@
 import click
 from sqlalchemy.future import select
 from sqlalchemy import Connection, insert, func
-from ee.src.models.db_models import OrganizationMemberDB  # type: ignore
-from ee.src.models.extended.deprecated_models import UserOrganizationDB  # type: ignore
+from oss.src.models.db_models import OrganizationMemberDB  # type: ignore
+from ee.databases.postgres.migrations.core.deprecated_models import UserOrganizationDB  # type: ignore
 
 BATCH_SIZE = 200
 

api/ee/databases/postgres/migrations/core/data_migrations/invitations.py

@@ -7,7 +7,7 @@
 from sqlalchemy import delete, Connection, insert, func
 
 from oss.src.models.db_models import UserDB, InvitationDB, ProjectDB
-from ee.src.models.extended.deprecated_models import OldInvitationDB
+from ee.databases.postgres.migrations.core.deprecated_models import OldInvitationDB
 
 
 BATCH_SIZE = 200