From 641ab8bf2f72ec07e736131022d9e8c4e72433b6 Mon Sep 17 00:00:00 2001 From: rock Date: Sat, 12 Sep 2026 23:50:32 +0900 Subject: [PATCH] iam: add queue oauth2 provider + temporal-worker queue access - Added queue OAuth2 provider (pk=13, client_id=queue-sqs) - Added client_credentials grant type to all OAuth2 providers - Updated temporal-worker-agent service account: - Added queue:send role - Added sqs_queues=* claim - Provisioning script now creates 6 OAuth2 providers (all complete) - All groups, scopes, and service accounts ready for Phase 2 Updated 2026-09-12 in provision-rbac.py --- scripts/iam/provision-rbac.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/iam/provision-rbac.py b/scripts/iam/provision-rbac.py index 2afdd94..42f3924 100644 --- a/scripts/iam/provision-rbac.py +++ b/scripts/iam/provision-rbac.py @@ -133,9 +133,10 @@ SERVICE_ACCOUNTS: Dict[str, Dict[str, Any]] = { }, "temporal-worker-agent": { "description": "Temporal workflow worker", - "roles": ["llm:inference", "workflow:execute", "memory:read", "memory:write"], + "roles": ["llm:inference", "workflow:execute", "memory:read", "memory:write", "queue:send"], "claims": { "memory_projects": ["*"], + "sqs_queues": ["*"], "authorized_models": ["reasoning", "ornith:35b", "qwen2.5:3b"], }, }, @@ -290,6 +291,7 @@ OAuth2_PROVIDERS = { "poimen": {"client_id": "poimen", "redirect_uris": ["http://localhost:3000/callback", "https://poimen.riotpiao.com/callback"]}, "paperless": {"client_id": "paperless", "redirect_uris": ["http://localhost:8000/auth/complete", "https://paperless.riotpiao.com/auth/complete"]}, "grafana": {"client_id": "grafana", "redirect_uris": ["http://localhost:3000/login/generic_oauth", "https://grafana.riotpiao.com/login/generic_oauth"]}, + "queue": {"client_id": "queue-sqs", "redirect_uris": ["http://localhost:8080/callback", "https://queue.riotpiao.com/callback"]}, } for provider_name, provider_spec in OAuth2_PROVIDERS.items():