fix(schedules): schedules and watches run as the data-analysis service principal #19

2026-10-16T13:27:27Z

KofTwentyTwo commented

2026-10-16 13:27:27 +00:00

(Migrated from github.com)

Part of the service-identity work, QRun-IO/qqq#1248. Draft: it needs the QQQ RC that contains qqq#1255 and #1256. Bump qqq.snapshot.version once the release captain cuts it.

Problem: on kof22 every data_analysis_run_schedules run fails with Invalid session in request. The self-made data-analysis-scheduler QSession is rejected by OAuth2.

Fix: AnalysisSessions picks the session for scheduled work.

When the host declares the principal (DataAnalysisQBitConfig.servicePrincipal, default data-analysis), schedule and watch inventory runs as it. Owner and recipient runs go through ServiceIdentities.sessionOnBehalfOf, which gives the user's current access intersected with the principal's. Record locks still apply per recipient.
A host ownerSessionSupplier still wins.
With no principal declared, the previous sessions are kept.
EffectiveConfigResolver's settings read stays on the system session. It is a per-request config read (plumbing, design section 6.3), not scheduled work.

Tests:

SchedulesTest.inventoryRunsAsTheDeclaredPrincipal: a principal without grants finds and sends nothing; with grants, the schedule runs and delivers.
Full suite: 311, 0 failures, against a local install of qqq#1256.

🤖 Generated with Claude Code

Part of the service-identity work, QRun-IO/qqq#1248. **Draft:** it needs the QQQ RC that contains qqq#1255 and #1256. Bump `qqq.snapshot.version` once the release captain cuts it. **Problem:** on kof22 every `data_analysis_run_schedules` run fails with `Invalid session in request`. The self-made `data-analysis-scheduler` QSession is rejected by OAuth2. **Fix:** `AnalysisSessions` picks the session for scheduled work. - When the host declares the principal (`DataAnalysisQBitConfig.servicePrincipal`, default `data-analysis`), schedule and watch inventory runs as it. Owner and recipient runs go through `ServiceIdentities.sessionOnBehalfOf`, which gives the user's current access intersected with the principal's. Record locks still apply per recipient. - A host `ownerSessionSupplier` still wins. - With no principal declared, the previous sessions are kept. - `EffectiveConfigResolver`'s settings read stays on the system session. It is a per-request config read (plumbing, design section 6.3), not scheduled work. **Tests:** - `SchedulesTest.inventoryRunsAsTheDeclaredPrincipal`: a principal without grants finds and sends nothing; with grants, the schedule runs and delivers. - Full suite: 311, 0 failures, against a local install of qqq#1256. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james.maes referenced this issue from a commit

2026-11-03 21:42:30 +00:00

Merge develop into release/0.1 for 0.1.0-RC.6 (#19 schedules and watches run as a service principal, QQQ RC.19)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-data-analysis#19