forked from lei.chen/myxce
673f2eb792
The MCP/apiserver returned the raw 64-bit job ID (e.g. 73930964699447296) while xce_test/xcecli display the dash form (e.g. 1-0-1786585485-0) that parse_jobid accepts. A user taking the numeric form into xce_test fails to parse it. The apiserver is the data-correctness owner (MCP only reads), so it now emits the controller's fmt_jobid form alongside the numeric ID: - models: JobSubmitResponse gains job_id_human; job list rows gain job_id_human (processJobData), using the existing backend.FormatJobID. - schedulerclient: URMJob.HumanID + SubmitJobResult.JobIDHuman parse it. - Tests: backend.FormatJobID (real t1 job, pre-cluster1 job, array child); processJobData adds job_id_human. Also rename the SSE permission event:subscribe → event:view so mcp_readonly stays strictly *:view (the read-only invariant test enforces). Verified live on t1: scheduler_submit returns job_id_human 1-0-1786586474-0 and scheduler_get_job returns human_id. Co-Authored-By: Claude <noreply@anthropic.com>
213 lines
5.7 KiB
YAML
213 lines
5.7 KiB
YAML
permissions:
|
|
- queue:view # view queue info
|
|
- queue:submit # submit job
|
|
- queue:control # close, open, active, deactive
|
|
- job:view # view job info
|
|
- job:control # stop, resume, kill, requeue, peek??, modify
|
|
- host:view # view host info
|
|
- host:control # close, open
|
|
- cluster:view # view cluster info
|
|
- cluster:control # shutdown, restart, reconfigure
|
|
- user:view # view user info)
|
|
- rbac:control # create, update, delete roles
|
|
- rbac:view # view role info
|
|
- file:control # upload, download,delete
|
|
- file:view # view file info
|
|
- hostgroup:view # view hostgroup info
|
|
- hostgroup:control # add
|
|
- usergroup:view # view usergroup info
|
|
- resource:view # view resource info
|
|
- event:view # subscribe to the live job-event SSE stream (scheduler-agent Phase 2)
|
|
- ar:view # view advanced reservation info
|
|
- ar:submit # submit advanced reservation
|
|
- ar:control # delete, modify, create
|
|
|
|
roles:
|
|
basic_user:
|
|
permissions:
|
|
|
|
- action: cluster:view
|
|
domain:
|
|
- type: all
|
|
- action: queue:view
|
|
domain:
|
|
- type: all
|
|
- action: queue:submit
|
|
domain:
|
|
- type: all
|
|
- action: job:view
|
|
domain:
|
|
- type: self
|
|
- type: self_ug
|
|
- action: host:view
|
|
domain:
|
|
- type: all
|
|
- action: rbac:view
|
|
domain:
|
|
- type: all
|
|
- action: user:view
|
|
domain:
|
|
- type: all
|
|
- action: file:view
|
|
domain:
|
|
- type: self
|
|
- action: job:control
|
|
domain:
|
|
- type: self
|
|
- action: hostgroup:view
|
|
domain:
|
|
- type: all
|
|
- action: usergroup:view
|
|
domain:
|
|
- type: all
|
|
- action: resource:view
|
|
domain:
|
|
- type: all
|
|
cluster_admin:
|
|
permissions:
|
|
- action: cluster:control
|
|
domain:
|
|
- type: self
|
|
- action: cluster:view
|
|
domain:
|
|
- type: all
|
|
- action: queue:submit
|
|
domain:
|
|
- type: all
|
|
- action: queue:control
|
|
domain:
|
|
- type: all
|
|
- action: queue:view
|
|
domain:
|
|
- type: all
|
|
- action: job:control
|
|
domain:
|
|
- type: all
|
|
- action: job:view
|
|
domain:
|
|
- type: all
|
|
- action: host:control
|
|
domain:
|
|
- type: all
|
|
- action: host:view
|
|
domain:
|
|
- type: all
|
|
- action: user:view
|
|
domain:
|
|
- type: all
|
|
- action: rbac:view
|
|
domain:
|
|
- type: all
|
|
- action: rbac:control
|
|
domain:
|
|
- type: all
|
|
- action: file:control
|
|
domain:
|
|
- type: all
|
|
- action: file:view
|
|
domain:
|
|
- type: all
|
|
- action: hostgroup:view
|
|
domain:
|
|
- type: all
|
|
- action: hostgroup:control
|
|
domain:
|
|
- type: all
|
|
- action: usergroup:view
|
|
domain:
|
|
- type: all
|
|
- action: resource:view
|
|
domain:
|
|
- type: all
|
|
- action: ar:view
|
|
domain:
|
|
- type: all
|
|
- action: ar:control
|
|
domain:
|
|
- type: all
|
|
- action: ar:submit
|
|
domain:
|
|
- type: all
|
|
queue_admin:
|
|
permissions:
|
|
- action: queue:submit
|
|
domain:
|
|
- type: queue
|
|
values: [normal,priority]
|
|
- action: queue:view
|
|
domain:
|
|
- type: all
|
|
- action: queue:control
|
|
domain:
|
|
- type: self
|
|
- action: job:view
|
|
domain:
|
|
- type: queue
|
|
values: [normal]
|
|
- action: job:control
|
|
domain:
|
|
- type: queue
|
|
values: [normal]
|
|
|
|
# mcp_readonly: service-account role for the scheduler-agent MCP server
|
|
# (Phase 0, read-only tools only). Deliberately excludes job:control,
|
|
# queue:control, host:control, cluster:control, rbac:*, file:*, user:* —
|
|
# an MCP server credential should never be able to mutate cluster state
|
|
# or manage other users/roles.
|
|
mcp_readonly:
|
|
permissions:
|
|
- action: job:view
|
|
domain:
|
|
- type: all
|
|
- action: queue:view
|
|
domain:
|
|
- type: all
|
|
- action: host:view
|
|
domain:
|
|
- type: all
|
|
- action: resource:view
|
|
domain:
|
|
- type: all
|
|
- action: cluster:view
|
|
domain:
|
|
- type: all
|
|
- action: event:view
|
|
domain:
|
|
- type: all
|
|
|
|
# mcp_operator: service-account role for the scheduler-agent MCP server
|
|
# (Phase 1, write operations). Same cluster visibility as mcp_readonly,
|
|
# plus queue:submit (scheduler_submit) and job:control (scheduler_cancel/
|
|
# hold/release). queue:control is required by the apiserver's job-control
|
|
# handler (jobs.go checks queue:control on the job's queue too), so it is
|
|
# granted here. An MCP server credential using this role can mutate job
|
|
# state, but still cannot manage other users/roles or cluster config.
|
|
mcp_operator:
|
|
permissions:
|
|
- action: job:view
|
|
domain:
|
|
- type: all
|
|
- action: queue:view
|
|
domain:
|
|
- type: all
|
|
- action: host:view
|
|
domain:
|
|
- type: all
|
|
- action: resource:view
|
|
domain:
|
|
- type: all
|
|
- action: cluster:view
|
|
domain:
|
|
- type: all
|
|
- action: queue:submit
|
|
domain:
|
|
- type: all
|
|
- action: queue:control
|
|
domain:
|
|
- type: all
|
|
- action: job:control
|
|
domain:
|
|
- type: all
|
|
- action: event:view
|
|
domain:
|
|
- type: all
|