refactor: make rbac package generic and reusable

[abelanger5]

Description

Moves the RBAC package to its own exported /pkg/auth/rbac directory so we can reuse it elsewhere. Decouples the OSS implementation from the permissions implementation.

Drive-by fix for CI issues:

• Runs the security check in a goroutine instead of defer - no change in risk since the method panicking out of defer would prevent startup regardless. There was some evidence locally of the security check blocking startup for a significant amount of time
• Rebalances inactive partitions during startup of the scheduler so that tenants which have never been active on a scheduler get started immediately. It seems that this + the security check being slow was preventing the tenant from scheduling workload immediately for the load tests
• Fixes a race condition on shutdown where we called wg.Add from a retry loop when our cleanup method was in wg.Wait

Type of change

• Refactor (non-breaking changes to code which doesn't change any behaviour)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hatchet-docs	Ready	Preview, Comment	Apr 13, 2026 0:58am

[juliusgeo]

LGTM!

[Copilot]

Pull request overview

This PR refactors the RBAC implementation into an exported pkg/auth/rbac package and moves Hatchet’s server-specific wiring (embedded YAML + OpenAPI spec loading) into api/v1/server/authz, aiming to make the RBAC logic reusable outside the API server.

Changes:

• Refactor pkg/auth/rbac to accept an injected permission map + OpenAPI spec instead of embedding/owning server-specific assets.
• Add api/v1/server/authz/rbac.go + rbac.yaml to host the Hatchet-specific embedded RBAC configuration and authorizer construction.
• Update the authz middleware and tests to use the new authorizer constructor.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/auth/rbac/rbac.go	Makes the RBAC package more generic by removing embedded YAML/spec loading and exposing LoadPermissionMap + a new NewAuthorizer signature.
api/v1/server/authz/rbac.yaml	Adds the server’s RBAC permission definitions as an embedded asset under authz.
api/v1/server/authz/rbac.go	Introduces Hatchet-specific authorizer construction by embedding YAML and loading the generated OpenAPI spec.
api/v1/server/authz/rbac_test.go	Updates tests to the new authz package layout and the new authorizer construction path.
api/v1/server/authz/middleware.go	Switches middleware wiring to use the new Hatchet-specific authorizer constructor and the new RBAC import path.

Comments suppressed due to low confidence (3)

pkg/auth/rbac/rbac.go:12

• The new reusable pkg/auth/rbac package still imports sqlcv1 and Authorizer.IsAuthorized is typed to sqlcv1.TenantMemberRole, which couples this “generic” RBAC package to the repository layer. Consider making the RBAC API accept a role name string (or rbac-defined type) and do sqlcv1 role conversion in api/v1/server/authz instead.
  pkg/auth/rbac/rbac.go:35
• NewAuthorizer dereferences permMap and spec without nil checks (permMap.ValidateSpec(*spec) and later *permMap). As this is now a reusable package API, it should return a clear error when permMap or spec is nil to avoid panics in callers.
  pkg/auth/rbac/rbac.go:146
• LoadPermissionMap can succeed when yamlBytes is empty/invalid but still unmarshals to a zero-value PermissionMap (e.g., Roles is nil), because Validate() currently returns nil in that case. That can lead to panics later when authorizing. Consider validating that yamlContents.Roles is non-nil/non-empty and returning an RBACError if not.

[github-actions]

Benchmark results

goos: linux
goarch: amd64
pkg: github.com/hatchet-dev/hatchet/internal/msgqueue/rabbitmq
cpu: AMD Ryzen 9 7950X3D 16-Core Processor          
                              │ /tmp/old.txt │            /tmp/new.txt            │
                              │    sec/op    │    sec/op     vs base              │
CompressPayloads_1x10KiB-8       79.05µ ± 3%   80.57µ ±  1%       ~ (p=0.132 n=6)
CompressPayloads_10x10KiB-8      900.6µ ± 1%   905.7µ ±  2%       ~ (p=0.180 n=6)
CompressPayloads_10x100KiB-8     10.84m ± 2%   10.91m ±  2%       ~ (p=0.937 n=6)
CompressPayloads_Concurrent-8    60.21µ ± 4%   64.26µ ± 24%       ~ (p=0.093 n=6)
geomean                          464.3µ        475.6µ        +2.43%

                              │ /tmp/old.txt │            /tmp/new.txt            │
                              │     B/op     │     B/op      vs base              │
CompressPayloads_1x10KiB-8      11.06Ki ± 1%   11.11Ki ± 2%       ~ (p=0.310 n=6)
CompressPayloads_10x10KiB-8     110.4Ki ± 1%   110.1Ki ± 1%       ~ (p=1.000 n=6)
CompressPayloads_10x100KiB-8    2.924Mi ± 0%   2.920Mi ± 0%       ~ (p=0.699 n=6)
CompressPayloads_Concurrent-8   54.24Ki ± 0%   54.26Ki ± 1%       ~ (p=1.000 n=6)
geomean                         118.7Ki        118.7Ki       +0.02%

                              │ /tmp/old.txt │            /tmp/new.txt            │
                              │  allocs/op   │ allocs/op   vs base                │
CompressPayloads_1x10KiB-8        5.000 ± 0%   5.000 ± 0%       ~ (p=1.000 n=6) ¹
CompressPayloads_10x10KiB-8       32.00 ± 0%   32.00 ± 0%       ~ (p=1.000 n=6) ¹
CompressPayloads_10x100KiB-8      63.00 ± 2%   63.00 ± 0%       ~ (p=1.000 n=6)
CompressPayloads_Concurrent-8     17.00 ± 0%   17.00 ± 0%       ~ (p=1.000 n=6) ¹
geomean                           20.35        20.35       +0.00%
¹ all samples are equal

_{Compared against main (4ba2c7e)}