Merge pull request #619 from s-and-p-team/feat/github-issue-agent-rbac-scope-gating

Feat/GitHub issue agent rbac scope gating

Author: pdettori

authbridge/demos/github-issue/aiac/.gitignore

@@ -5,7 +5,7 @@ aiac.env
 aiac_agent/config/llm_conf.yaml
 
 # Generated policy files — created at runtime by aiac_cli.py.
-generated_configs/
+config/
 
 # Python virtual environment
 venv/

authbridge/demos/github-issue/aiac/Makefile

@@ -31,10 +31,12 @@ help:  ## Show this menu (default)
 	     $(MAKEFILE_LIST)
 	@printf "\nVariables:\n"
 	@printf "  \033[36m%-20s\033[0m %s\n" "POLICY" "policy file to apply (default: policies/regular_policy.txt)"
+	@printf "  \033[36m%-20s\033[0m %s\n" "RBAC_CONFIG" "RBAC config file (default: rbac/config.yaml)"
 	@printf "  \033[36m%-20s\033[0m %s\n" "PYTHON"  "Python interpreter (default: kagenti-extensions/.venv/bin/python)"
 	@printf "\nPrerequisites: uv, Keycloak running, aiac.env and llm_conf.yaml configured.\n\n"
 
 POLICY ?= policies/regular_policy.txt
+RBAC_CONFIG ?= rbac/config.yaml
 
 # Resolve the venv relative to this Makefile, regardless of where make is invoked.
 MAKEFILE_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
@@ -81,28 +83,28 @@ preflight:  ## Verify prerequisites (uv, venv, aiac.env, llm_conf.yaml, Keycloak
 
 setup: preflight  ## Provision Keycloak realm with clients, roles, and users
 	@echo "[*] Provisioning Keycloak realm ..."
-	$(PYTHON) ../setup_keycloak.py -rbac config.yaml
+	$(PYTHON) ../setup_keycloak.py -rbac $(RBAC_CONFIG)
 	@echo "[✓] Keycloak realm provisioned."
 
 # ---------- Apply policy ----------
 
 apply-policy: preflight  ## Generate + apply POLICY (default: policies/regular_policy.txt) to Keycloak
 	@echo "[*] Running AIAC full pipeline: $(POLICY)"
-	$(PYTHON) aiac_cli.py --yes $(POLICY)
+	$(PYTHON) aiac_cli.py $(POLICY)
 
 apply-permissive: POLICY = policies/permissive_policy.txt
 apply-permissive: apply-policy  ## Generate + apply the permissive policy (grants Sales access)
 
 # ---------- Show result ----------
 
 show-result: preflight  ## Show active composite-role mappings in Keycloak (verify applied policy)
-	$(PYTHON) scripts/show-result.py
+	$(PYTHON) scripts/show-result.py --config-path ../$(RBAC_CONFIG)
 
 # ---------- Reset ----------
 
 reset: preflight  ## Wipe generated configs and re-provision the realm from scratch
 	@echo "[*] Removing generated configs ..."
-	@rm -f generated_configs/*.yaml
+	@rm -f config/*.yaml
 	@echo "[*] Re-provisioning Keycloak realm ..."
-	$(PYTHON) ../setup_keycloak.py -rbac config.yaml
+	$(PYTHON) ../setup_keycloak.py -rbac $(RBAC_CONFIG)
 	@echo "[✓] Reset complete."

authbridge/demos/github-issue/aiac/aiac_cli.py

@@ -149,12 +149,11 @@ def run_full_pipeline(policy_text_file: str, policy_name: str | None, yes: bool
     print_info(f"Policy name: {policy_name}")
     print()
 
-    generated_configs_dir = script_dir / "generated_configs"
+    generated_configs_dir = script_dir / "config"
     generated_configs_dir.mkdir(exist_ok=True)
 
     config_file = generated_configs_dir / f"{policy_name}_config.yaml"
     policy_file = generated_configs_dir / f"{policy_name}_policy.yaml"
-    main_config = "config.yaml"
 
     realm_name = os.getenv("REALM_NAME", "demo")
     keycloak_url = os.getenv("KEYCLOAK_URL")
@@ -212,7 +211,7 @@ def run_full_pipeline(policy_text_file: str, policy_name: str | None, yes: bool
             realm_name=realm_name,
             user_realm_name="master",
         )
-        delete_access_control_policy(admin, realm_name, script_dir / main_config)
+        delete_access_control_policy(admin, realm_name, config_file=config_file)
         print_success("Old rules removed successfully")
         print()
 
@@ -226,8 +225,8 @@ def run_full_pipeline(policy_text_file: str, policy_name: str | None, yes: bool
         print_success(f"Policy '{policy_name}' has been successfully updated in Keycloak")
         print()
         print_info("Generated files:")
-        print(f"  - Configuration: generated_configs/{config_file.name}")
-        print(f"  - Rules: generated_configs/{policy_file.name}")
+        print(f"  - Configuration: {config_file}")
+        print(f"  - Rules: {policy_file}")
 
     except Exception as e:
         print_error(f"An error occurred: {e}")

authbridge/demos/github-issue/aiac/scripts/show-result.py

@@ -9,6 +9,7 @@
 Run via: make show-result
 """
 
+import argparse
 import os
 import sys
 from pathlib import Path
@@ -46,6 +47,15 @@ def section(title: str) -> None:
 
 
 def main() -> None:
+    parser = argparse.ArgumentParser(description="Display composite-role mappings currently active in Keycloak")
+    parser.add_argument(
+        "--config-path",
+        type=Path,
+        required=True,
+        help="Path to the RBAC configuration YAML file",
+    )
+    args = parser.parse_args()
+
     try:
         admin = KeycloakAdmin(
             server_url=KEYCLOAK_URL,
@@ -58,7 +68,11 @@ def main() -> None:
         print(f"{RED}ERROR: Could not connect to Keycloak at {KEYCLOAK_URL}: {e}{RESET}")
         sys.exit(1)
 
-    config_path = AIAC_DIR / "config.yaml"
+    config_path = args.config_path
+    if not config_path.exists():
+        print(f"{RED}ERROR: Config file not found: {config_path}{RESET}")
+        sys.exit(1)
+
     with open(config_path) as f:
         config = yaml.safe_load(f)
 
@@ -85,7 +99,7 @@ def main() -> None:
                 name = c.get("name", "?")
                 print(f"    {GREEN}✓{RESET}  {container}.{name}")
 
-    gen_dir = AIAC_DIR / "generated_configs"
+    gen_dir = AIAC_DIR / "config"
     policy_files = list(gen_dir.glob("*_policy.yaml")) if gen_dir.exists() else []
     if policy_files:
         latest = max(policy_files, key=lambda p: p.stat().st_mtime_ns)

authbridge/demos/github-issue/demo-aiac.md

@@ -378,7 +378,7 @@ REALM_NAME=kagenti
 Run the setup script to create the demo realm with clients, roles, and users:
 
 ```bash
-python setup_keycloak.py -rbac config.yaml
+python setup_keycloak.py -rbac rbac/config.yaml
 ```
 
 Open bash inside the test client pod
@@ -560,26 +560,26 @@ python aiac_cli.py policies/regular_policy.txt
 ```
 
 Review generated files:
-  - Configuration: generated_configs/regular_policy_config.yaml
-  - Rules: generated_configs/regular_policy_policy.yaml
+  - Configuration: config/regular_policy_config.yaml
+  - Rules: config/regular_policy_policy.yaml
 
 
 Verify results
 ```bash
 echo "1. Developer has github-full-access:"
-yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-full-access")' generated_configs/regular_policy_policy.yaml
+yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-full-access")' config/regular_policy_policy.yaml
 
 echo -e "\n2. Developer has github-tool-aud:"
-yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-tool-aud")' generated_configs/regular_policy_policy.yaml
+yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-tool-aud")' config/regular_policy_policy.yaml
 
 echo -e "\n3. Tech-support has github-tool-aud:"
-yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-tool-aud")' generated_configs/regular_policy_policy.yaml
+yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-tool-aud")' config/regular_policy_policy.yaml
 
 echo -e "\n4. Tech-support does NOT have github-full-access (should be empty):"
-yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-full-access")' generated_configs/regular_policy_policy.yaml
+yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-full-access")' config/regular_policy_policy.yaml
 
 echo -e "\n5. Sales does NOT exist in policy (should be null):"
-yq '.policy.sales' generated_configs/regular_policy_policy.yaml
+yq '.policy.sales' config/regular_policy_policy.yaml
 ```
 Expected output :
 ```bash
@@ -641,7 +641,7 @@ echo "Client ID: $CLIENT_ID  Secret length: ${#CLIENT_SECRET}"
 
 
 # step 2 - run AIAC using regualr policy
-# python AIAC.py policy/regular_policy.txt
+# python aiac_cli.py policies/regular_policy.txt
 # users will be configured acording to the 'regular' policy
 #ALICE (Developer) can list issues in kagenti/kagenti repo
 #ALICE can also list issues in omerboehm/intro2c repo (because she is a DEVELOPER and has full access)
@@ -791,26 +791,26 @@ Apply the updated policy
 python aiac_cli.py policies/permissive_policy.txt
 ```
 Review generated files:
-  - Configuration: generated_configs/permissive_policy_config.yaml
-  - Rules: generated_configs/permissive_policy_policy.yaml
+  - Configuration: config/permissive_policy_config.yaml
+  - Rules: config/permissive_policy_policy.yaml
 
 
 Verify results
 ```bash
 echo "1. Developer has github-full-access:"
-yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-full-access")' generated_configs/permissive_policy_policy.yaml
+yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-full-access")' config/permissive_policy_policy.yaml
 
 echo -e "\n2. Developer has github-tool-aud:"
-yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-tool-aud")' generated_configs/permissive_policy_policy.yaml
+yq '.policy.developer[] | select(.client == "github-tool" and .role == "github-tool-aud")' config/permissive_policy_policy.yaml
 
 echo -e "\n3. Tech-support has github-tool-aud:"
-yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-tool-aud")' generated_configs/permissive_policy_policy.yaml
+yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-tool-aud")' config/permissive_policy_policy.yaml
 
 echo -e "\n4. Tech-support does NOT have github-full-access (should be empty):"
-yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-full-access")' generated_configs/permissive_policy_policy.yaml
+yq '.policy.tech-support[] | select(.client == "github-tool" and .role == "github-full-access")' config/permissive_policy_policy.yaml
 
 echo -e "\n5. Sales is now just like Tech-support (\"Other personnel\"):"
-yq '.policy.sales[] | select(.client == "github-tool" and .role == "github-tool-aud")' generated_configs/permissive_policy_policy.yaml
+yq '.policy.sales[] | select(.client == "github-tool" and .role == "github-tool-aud")' config/permissive_policy_policy.yaml
 ```
 Expected output :
 ```txt
@@ -831,17 +831,18 @@ role: github-tool-aud
 5. Sales is now just like Tech-support ("Other personnel"):
 client: github-tool
 role: github-tool-aud
-
+```
 
 
 ### Step 17: Reset Realm (Optional)
 
 To clean up and start fresh:
 
 ```bash
+cd demos/github-issue/
 # delete generated policies
-rm -f generated_configs/*.yaml
+rm -f aiac/config/*.yaml
 
 # re-provision the realm
-python setup_keycloak.py -rbac config.yaml
+python setup_keycloak.py -rbac rbac/config.yaml
 ```