ogar-rbac: IdentityActors answers through the contract's SubjectRoles

[AdaWorldAPI]

HubSPO wishlist #11, the OGAR half. The one-subject rule now lives once, in lance_graph_contract::rbac_plug::SubjectRoles (lance-graph #1491, merged): the subject holds its roles, and every other actor holds none, including the acting party of a delegated login. IdentityActors uses it instead of its own comparison.

One behaviour change: a user whose subject is empty now holds no role. Before, an actor id that also failed to resolve to an empty string would have matched it and picked up its roles.

Tests:

• New test an_empty_subject_holds_no_role: verified red against the previous IdentityActors and green after.
• The existing subject-only and delegated-login tests are unchanged and green: cargo test -p ogar-rbac passes 21.

Lint: clippy (-D warnings) and fmt are clean on ogar-rbac.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

---

Generated by Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Empty subjects no longer receive roles or memberships.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T13:22:23.906892Z	dece4dc	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 688adecf-154a-45ff-8f40-0d71187d352b

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between 9803380 and dece4dc.

---

---

📒 Files selected for processing (1)

• crates/ogar-rbac/src/lib.rs

---

---

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

---

---

📝 Walkthrough

📝 Walkthrough

Walkthrough

IdentityActors now stores its subject and filtered roles in SubjectRoles. Its roles_of method delegates actor matching and role lookup to that value. A test checks that an empty subject has no roles or memberships.

Changes

Identity role lookup

Layer / File(s)	Summary
SubjectRoles integration crates/ogar-rbac/src/lib.rs	IdentityActors stores its subject and filtered roles in SubjectRoles. roles_of delegates actor matching and role retrieval to it. A test checks that an empty subject yields no roles or memberships.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Suggested reviewers: claude

---

---

Merge Risk: ⚪ Minimal · up to dece4

The change moves role lookup into SubjectRoles and adds an empty-subject test. No concrete regression is established, though the external implementation could not be inspected; normal build and test validation remains appropriate.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: IdentityActors now uses the contract's SubjectRoles.

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{A rabbit checks the roles in store
An empty subject gets no more
SubjectRoles keeps the fields in line
The lookup follows one clear design
The rabbit hops away, content and fine}

_{Comment @coderabbitai help to get the list of available commands.}