ovstorage-contributor-modify-authz-layer

Use when changing or reviewing the built-in authentication and authorization Layer or its TOML policy engine.

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/NVIDIA-Omniverse/ovstorage --skill ovstorage-contributor-modify-authz-layer

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Use when adding or reviewing a storage backend plugin for ovstorage.

Use when Rust changes affect the ovstorage plugin ABI header and the checked-in generated copies must be refreshed.

Use when starting ovstorage-broker locally for development or integration testing with the current Stack and listener-auth configuration.

name	ovstorage-contributor-modify-authz-layer
description	Use when changing or reviewing the built-in authentication and authorization Layer or its TOML policy engine.
license	CC-BY-4.0
version	0.1.0
author	NVIDIA Omniverse
tags	["ovstorage","authz","layer","policy"]
tools	["Read","Write","Bash"]
compatibility	Requires an ovstorage checkout and Rust toolchain. No external credentials are required for unit tests.

Change the built-in builtin-auth Layer or its pure policy engine without weakening the host's fail-closed behavior.

Read docs/public/authz-policy/README.md.
Route Layer composition, authentication, and request gating changes to ovstorage-remote/ovstorage-authz-layer/.
Route TOML parsing, operation mapping, rule precedence, and list filtering changes to ovstorage-remote/ovstorage-authz-policy/.
Keep transport-derived identity values in ovstorage-remote/ovstorage-authz-context/.
Preserve deny-by-default parsing, atomic policy replacement, and authorization above caches in the Stack.
Add focused tests in the owning crate, then run:

cargo test -p ovstorage-authz-policy
cargo test -p ovstorage-authz-layer
make verify

Listener auth accepts builtin-auth and loaded storage Layer wrappers whose descriptor declares auth_capable = true. Missing, unknown, non-wrapper, and non-auth-capable kinds fail startup.
The policy document's plugin = "ovstorage-authz-toml" field is a retained schema discriminator, not a cdylib selection mechanism.
Do not introduce a parallel authorization ABI. External auth wrappers use the storage Layer contract, own their config schema, and do not receive the built-in typed policy hot-reload operation. Broker SIGHUP reconstructs them from config as part of the fresh broker.