feat(rbac): enhance function registration with new hooks and RBAC con…

[sergiofilhowz]

…trols

Summary by CodeRabbit

• Documentation
  • RBAC docs updated to support gated function registration: function registration is allowed only when the RBAC result permits it and an optional validation hook approves; otherwise registrations are silently dropped.
  • Clarified that unregistering functions owned by a worker is permitted.
  • WebSocket protocol docs updated to reflect these registration gating semantics.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
iii-website	Ready	Preview, Comment	Mar 28, 2026 1:51am
motia-docs	Ready	Preview, Comment	Mar 28, 2026 1:51am

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
iii	🟢 Ready	View Preview	Mar 28, 2026, 1:33 AM

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: a5cf94d4-6075-40a0-ae79-666ea9f079b0

📥 Commits

Reviewing files that changed from the base of the PR and between 27f2884 and 6e6d406.

📒 Files selected for processing (1)

• docs/modules/module-worker.mdx

---

📝 Walkthrough

Walkthrough

Updates worker module docs to add RBAC-controlled function registration gating: a new on_function_registration_function_id hook config, an AuthResult.allow_function_registration boolean (default true), and revised protocol semantics allowing registerfunction/unregisterfunction under the new gating rules.

Changes

Cohort / File(s)

Summary

Worker module docs docs/modules/module-worker.mdx

Added modules::worker::WorkerModule.config.rbac.on_function_registration_function_id; added AuthResult.allow_function_registration (bool, default true); introduced FunctionRegistrationHookInput type (function_id, description, metadata, context); replaced "Trigger Registration" with "Registration Gating" flow; updated WebSocket protocol table to allow registerfunction on RBAC ports when gating permits and clarified unregisterfunction semantics.

Sequence Diagram(s)

sequenceDiagram
    participant Worker
    participant RBAC/Auth
    participant EngineHook
    participant Registry

    Worker->>RBAC/Auth: connect & request registerfunction(payload)
    RBAC/Auth->>RBAC/Auth: evaluate AuthResult (allow_function_registration)
    alt allow_function_registration == true and hook configured
        RBAC/Auth->>EngineHook: call on_function_registration_function_id(FunctionRegistrationHookInput)
        EngineHook-->>RBAC/Auth: return true/false
        alt hook == true
            RBAC/Auth->>Registry: accept registration -> store function
            Registry-->>Worker: registration acknowledged
        else hook == false
            RBAC/Auth-->>Worker: silent drop (no registration)
        end
    else allow_function_registration == false
        RBAC/Auth-->>Worker: silent drop (no registration)
    end
    Worker->>RBAC/Auth: unregisterfunction(function_id)
    RBAC/Auth->>Registry: remove function if owned by Worker
    Registry-->>Worker: unregister acknowledged

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• feat(rbac): enhance function registration with new hooks and RBAC con… #1373: Modifies the same Worker RBAC docs and adds on_function_registration_function_id plus AuthResult.allow_function_registration.
• feat(rbac): add function registration hooks and RBAC controls #1371: Implements the same function-registration RBAC surface across engine/session handling, SDK types, and tests.

Poem

🐰 Hopping through docs with a ribbon and grin,
I add a small gate where new functions begin,
A hook to consult and a flag shining bright,
So workers may register when the rules say it's right. 🥕

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat(rbac): enhance function registration with new hooks and RBAC con…' clearly describes the main changes: adding new hooks and RBAC controls for function registration, which aligns with the additions of on_function_registration_function_id hook and allow_function_registration field.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/iii-rbac-docs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docs/modules/module-worker.mdx`:
- Line 289: Update the `registerfunction` protocol documentation row to include
the optional `description?` parameter alongside `function_id` and `metadata`,
and change the text to state that on RBAC ports registration requires
`allow_function_registration` and that the
`on_function_registration_function_id` hook must return true (not merely be
called) for registration to proceed; also scan engine/ codepaths that implement
registerfunction to ensure they accept `description` and enforce the
hook-return-true behavior and reconcile any mismatches.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3ce01406-1831-4ed3-a693-68fc7592313f

📥 Commits

Reviewing files that changed from the base of the PR and between 9ea9e4e and 27f2884.

📒 Files selected for processing (1)

• docs/modules/module-worker.mdx