fix(authz): adapt plugin route derivation to fastapi 0.138 lazy include_router

fastapi 0.138 / starlette 1.3.1 made include_router(prefix=...) lazy: rebased routes are stashed behind a _IncludedRouter proxy instead of being materialized as APIRoute objects, so the derivation's walk of composed.routes found nothing and every plugin route was treated as unruled.

Add _iter_composed_routes() to descend each proxy's effective_route_contexts(), yielding composed-path APIRoute copies (original .endpoint preserved so get_path_rules still resolves the @path_rule metadata) and the composed starlette_route for WebSocket/Mount leaves (so the fail-closed branches still fire and no route is silently dropped). Downstream derivation logic is unchanged; the helper passes concrete routes through, so it also works if eager-include behavior returns.

Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>

Author: maxdubrinsky

packages/nemo_platform_plugin/src/nemo_platform_plugin/authz_discovery.py

@@ -25,7 +25,9 @@
 
 from __future__ import annotations
 
+import copy
 import logging
+from collections.abc import Iterator
 from dataclasses import dataclass, field
 from typing import Any
 
@@ -41,6 +43,7 @@
 )
 from nemo_platform_plugin.authz_format import is_valid_permission_id
 from nemo_platform_plugin.service import NemoService
+from starlette.routing import BaseRoute
 
 logger = logging.getLogger(__name__)
 
@@ -162,6 +165,54 @@ def _register_permission(catalog: dict[str, Permission], perm: Permission, warni
     catalog.setdefault(perm.id, perm)
 
 
+def _iter_composed_routes(service: NemoService) -> Iterator[BaseRoute]:
+    """Yield the fully-composed leaf routes of *service*, one ``BaseRoute`` per mounted route.
+
+    This re-creates the runtime mount (``/apis/<name>`` + ``RouterSpec.prefix`` + route path)
+    and flattens it to leaves so the derivation can read each route's final ``.path``,
+    ``.methods``, and (for ``APIRoute``) original ``.endpoint``.
+
+    Lazy-include workaround (fastapi 0.138.0 / starlette 1.3.1): ``include_router(prefix=...)``
+    no longer materializes rebased ``APIRoute`` objects into ``.routes`` — it stores a
+    ``fastapi.routing._IncludedRouter`` proxy, so walking ``.routes`` for ``APIRoute`` finds
+    nothing. We descend each proxy via ``effective_route_contexts()`` (which also recurses
+    through nested includes) and reconstruct the composed leaves:
+
+    - For an ``APIRoute`` we shallow-copy the original and overwrite ``.path``/``.methods`` with
+      the context's composed values. The copy keeps ``isinstance(route, APIRoute)`` true and
+      preserves the original ``.endpoint`` object so ``get_path_rules(route.endpoint)`` still
+      finds the function-attached rules; copying (rather than mutating) avoids corrupting the
+      shared original route.
+    - For non-``APIRoute`` leaves (WebSocketRoute / Mount / plain Route) we yield the context's
+      ``starlette_route``, which already carries the composed path — so the existing
+      fail-closed / warning branches still fire and no route is silently dropped.
+
+    A concrete route appearing directly in ``.routes`` (e.g. a future eager-include path) is
+    yielded as-is, so this keeps working if the proxy behavior changes again.
+    """
+    composed = APIRouter()
+    for spec in service.get_routers():
+        composed.include_router(spec.router, prefix=f"/apis/{service.name}{spec.prefix}")
+
+    for route in composed.routes:
+        contexts = getattr(route, "effective_route_contexts", None)
+        if contexts is None:
+            # Already a concrete leaf (no lazy-include proxy) — pass it through unchanged.
+            yield route
+            continue
+        for ctx in contexts():
+            original = ctx.original_route
+            if isinstance(original, APIRoute):
+                # Rebased APIRoute: copy + composed path/methods, original endpoint preserved.
+                rebased = copy.copy(original)
+                rebased.path = ctx.path
+                rebased.methods = ctx.methods
+                yield rebased
+            else:
+                # WS / Mount / plain Route: the composed-path route is on the context.
+                yield ctx.starlette_route or original
+
+
 def _derive_service_contribution(service: NemoService) -> tuple[AuthzContribution, list[str], list[str]]:
     """Derive one plugin's wire contribution, split into deny-worthy errors and warnings.
 
@@ -180,16 +231,12 @@ def _derive_service_contribution(service: NemoService) -> tuple[AuthzContributio
     warnings: list[str] = []
     catalog: dict[str, Permission] = {}
 
-    # Re-create the runtime mount: /apis/<name> + RouterSpec.prefix + route path.
-    composed = APIRouter()
-    for spec in service.get_routers():
-        composed.include_router(spec.router, prefix=f"/apis/{service.name}{spec.prefix}")
-
-    # Pass 1: walk routes, collapse OR'd rules, and collect referenced permissions.
-    # ``bindings`` holds the tentative allow binding per (path, method); unruled / invalid
-    # routes are recorded as None and become DENY regardless of namespace validity.
+    # Pass 1: walk the fully-composed leaf routes (/apis/<name> + RouterSpec.prefix + route
+    # path), collapse OR'd rules, and collect referenced permissions. ``bindings`` holds the
+    # tentative allow binding per (path, method); unruled / invalid routes are recorded as None
+    # and become DENY regardless of namespace validity.
     bindings: dict[str, dict[str, AuthzEndpointMethod | None]] = {}
-    for route in composed.routes:
+    for route in _iter_composed_routes(service):
         if not isinstance(route, APIRoute):
             # Mount / plain Starlette Route / WebSocket route — not an HTTP API route the PDP
             # binds by (path, method). Never silently skip it (that lets it fall through the

packages/nemo_platform_plugin/tests/test_factory_authz.py

@@ -39,13 +39,25 @@ async def _compiler(*args: object, **kwargs: object) -> object:  # never called
 
 
 def _rules_by_path_method(router: APIRouter) -> dict[tuple[str, str], list]:
-    """Map (path, lower-method) -> attached PathRules for every APIRoute in *router*."""
+    """Map (composed-path, lower-method) -> attached PathRules for every APIRoute in *router*.
+
+    fastapi 0.138.0 makes ``include_router(prefix=...)`` lazy: rebased ``APIRoute``\\ s live
+    behind a ``_IncludedRouter`` proxy rather than in ``.routes``. Descend the proxy via
+    ``effective_route_contexts()`` to read each route's composed path/methods and original
+    endpoint (which still carries the ``@path_rule`` metadata).
+    """
     out: dict[tuple[str, str], list] = {}
     for route in router.routes:
-        if not isinstance(route, APIRoute):
+        contexts = getattr(route, "effective_route_contexts", None)
+        if contexts is None:
+            if isinstance(route, APIRoute):
+                for method in route.methods or set():
+                    out[(route.path, method.lower())] = get_path_rules(route.endpoint)
             continue
-        for method in route.methods or set():
-            out[(route.path, method.lower())] = get_path_rules(route.endpoint)
+        for ctx in contexts():
+            if isinstance(ctx.original_route, APIRoute):
+                for method in ctx.methods or set():
+                    out[(ctx.path, method.lower())] = get_path_rules(ctx.original_route.endpoint)
     return out
 
 

packages/nemo_platform_plugin/tests/test_path_rule.py

@@ -22,7 +22,7 @@
     perm,
     validate_caller_strings,
 )
-from nemo_platform_plugin.authz_discovery import _method_from_dict
+from nemo_platform_plugin.authz_discovery import _iter_composed_routes, _method_from_dict
 from nemo_platform_plugin.service import NemoService, RouterSpec
 
 _READ = Permission("x.read", "Read x")
@@ -121,7 +121,12 @@ async def handler() -> None: ...
 
 
 def test_path_rule_survives_router_prefix_rebasing() -> None:
-    """D5: function-attached metadata must survive include_router(prefix=...) rebasing."""
+    """D5: function-attached metadata must survive include_router(prefix=...) rebasing.
+
+    fastapi 0.138.0 makes ``include_router(prefix=...)`` lazy (rebased routes live behind a
+    ``_IncludedRouter`` proxy, not in ``.routes``), so discoverability is asserted via the
+    derivation's composed-route enumeration rather than by scanning raw ``.routes``.
+    """
     router = APIRouter()
     items_read = Permission("items.read", "Read items")
 
@@ -131,16 +136,25 @@ async def get_item(name: str) -> dict[str, str]:
         return {"name": name}
 
     # Two prefix hops, as a real plugin mount does (/apis/<plugin> then workspace prefix).
+    # _iter_composed_routes re-creates the /apis/<name> mount, so the spec supplies only the
+    # inner workspace prefix; the helper prepends /apis/example.
     inner = APIRouter()
     inner.include_router(router, prefix="/v2/workspaces/{workspace}")
-    app_router = APIRouter()
-    app_router.include_router(inner, prefix="/apis/example")
 
-    matching = [r for r in app_router.routes if isinstance(r, APIRoute) and r.path.endswith("/items/{name}")]
+    class _Svc(NemoService):
+        name = "example"
+
+        def get_routers(self) -> list[RouterSpec]:
+            return [RouterSpec(inner)]
+
+    matching = [
+        r for r in _iter_composed_routes(_Svc()) if isinstance(r, APIRoute) and r.path.endswith("/items/{name}")
+    ]
     assert len(matching) == 1
     final_route = matching[0]
     assert final_route.path == "/apis/example/v2/workspaces/{workspace}/items/{name}"
 
+    # Metadata survived the rebase: the rule is still readable off the (identity-preserved) endpoint.
     rules = get_path_rules(final_route.endpoint)
     assert len(rules) == 1
     assert rules[0].callers == [CallerKind.PRINCIPAL]