WIP: add local sudo capability on devices#317
Draft
michaelw wants to merge 25 commits into
Draft
Conversation
Unmarshal the full merged config in MergeConfiguration and apply that end state directly instead of routing a sparse diff back through the sync apply path. Keep applyPatch as the helper for real partial section diffs, and factor shared normalization/store helpers so both flows continue to validate and normalize definitions before persisting them.
Snapshot the current config generation before building the merged sync view, normalize the merged role/workflow/provider definition maps off-lock, and only commit them if the generation is unchanged. Keep the retry logic scoped to MergeConfiguration, compare and commit definitions only, and detach the snapshot through JSON so stale retries do not alias nested state. Reloaded definitions now bump the generation counter, while broader nested-mutation cleanup remains tracked in #306.
* mw/fix-config-sync-apply: Retry config sync on concurrent changes Fix synced config application
michaelw
force-pushed
the
mw/local-sudo-request
branch
4 times, most recently
from
602eaea to
5b76f44
Compare
michaelw
force-pushed
the
mw/local-sudo-request
branch
from
5b76f44 to
a528efe
Compare
michaelw
force-pushed
the
mw/local-sudo-request
branch
from
a528efe to
1aac00a
Compare
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
# Conflicts: # Makefile # internal/config/providers.go # internal/config/services/temporal/main.go # internal/models/provider_workflows.go # internal/workflows/tasks/providers/thand/approvals.go # internal/workflows/tasks/providers/thand/authorize.go # internal/workflows/tasks/providers/thand/revoke.go
| if cancelPresence != nil { | ||
| cancelPresence() | ||
| } | ||
| pendingPresence-- |
EnsureDeviceRegistryWorkflows and PublishConfiguredDeviceDefinitions call TemporalClient.GetClient(), which blocks on the readyCh until StartWorkers closes it. Running them inside SetupTemporal (registration phase) deadlocks because StartTemporalWorkers is invoked later. Move them to run after StartWorkers so the client is ready when they execute.
The merge from main reintroduced the pattern where the authorize/revoke child workflows expect a WorkflowRoleRequest and resolve it to an AuthorizeRoleRequest inside the workflow via a local activity. The branch design instead pre-builds the AuthorizeRoleRequest at execution-planning time and stores it on ExecutionPlanEntry, and the thand task caller already invokes the child workflow with the pre-built type. That mismatch caused integration failures with: unable to decode the workflow function input payload: cannot unmarshal object into Go struct field WorkflowRoleRequest.identity of type string Restore the branch's signatures so the workflows accept the materialized request types directly. The BuildAuthorizeRoleRequest activity remains registered for callers that still build via WorkflowRoleRequest, but the provider child workflows themselves no longer depend on it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
device_idplumbing plus shared device routing and shared device-definition registries for device-targeted workflowsWhat Changed
Canonical device identity and shared device routing
device_idthe only device identity used for registration, routing, execution planning, and local sudothand config device-idExecution planning for device-targeted workflows
Local sudo
thand request sudoto the current machine only when--deviceis omittedmacOS privilege services
(currently not built in CI until we have Apple Signing secrets sorted out, can be built locally)
Small follow-ups included in the branch
localhostwhile usingthand.testonly for container-to-host reachabilityTesting
go test ./internal/common ./internal/config ./internal/daemon ./cmd/cli ./internal/workflows/tasks/providers/thand ./internal/models ./internal/providers/local ./internal/localbrokergo test -tags thand_dev ./internal/common./scripts/test-macos-privilege-services.shNotes