Introduce new scopes for admin level consent APIs#8180
Conversation
📝 WalkthroughWalkthroughTwo pairs of files are updated to register Consent Management V2 consents endpoints as system API resources with view/create/update scopes at both tenant and organization levels, and to expand the corresponding resource access control rules from simple method entries to operation-based authorization with a new PATCH-by-id rule. ChangesConsent Management V2 Consents Authorization
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2 (1)
495-505: 🔒 Security & Privacy | 🔵 TrivialConstrain consent ID routes to single path segment to prevent regex overlap.
The current regex patterns
(.+)$on lines 379 and 387 (organization) and 453 and 461 (tenant) in the static XML, and the corresponding lines in the.j2file, unintentionally match nested paths like/consents/{id}/validate. This creates overlap: requests to/consents/abc/validatematch both the by-id GET rule and the dedicated validate route rule.Change
(.+)to[^/]+in all four consent by-id routes (both GET and PATCH, organization and tenant, in both files). This restricts the ID capture to a single path segment, eliminating overlap and making routing intent explicit without changing authorization behavior for valid single-segment IDs.Pattern comparison
/o/api/identity/consent-mgt/v2.0/consents/abc/validate Current patterns (overlapping): ✓ matches: (.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)$ ✓ matches: (.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)/validate With proposed fix ([^/]+): ✗ no match: (.*)/o/api/identity/consent-mgt/v2.0/consents/[^/]+$ ✓ matches: (.*)/o/api/identity/consent-mgt/v2.0/consents/[^/]+/validate🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2` around lines 495 - 505, In the resource-access-control-v2.xml.j2 file, replace the regex pattern `(.+)$` with `[^/]+$` in all consent by-id route definitions to prevent regex overlap. Specifically, update the context attribute in both the GET and PATCH Resource elements that match the consent-mgt v2.0 consents by-id endpoint patterns. The pattern `[^/]+` will restrict the ID capture to a single path segment without slashes, eliminating unintended matches to nested paths like `/consents/{id}/validate` while maintaining the same authorization behavior for valid single-segment IDs. Ensure this change is applied to all four occurrences in the file (both GET and PATCH methods).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2`:
- Around line 495-505: In the resource-access-control-v2.xml.j2 file, replace
the regex pattern `(.+)$` with `[^/]+$` in all consent by-id route definitions
to prevent regex overlap. Specifically, update the context attribute in both the
GET and PATCH Resource elements that match the consent-mgt v2.0 consents by-id
endpoint patterns. The pattern `[^/]+` will restrict the ID capture to a single
path segment without slashes, eliminating unintended matches to nested paths
like `/consents/{id}/validate` while maintaining the same authorization behavior
for valid single-segment IDs. Ensure this change is applied to all four
occurrences in the file (both GET and PATCH methods).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: d719f1b2-75c5-41f1-9022-3cb03ee6eae0
📒 Files selected for processing (4)
features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xmlfeatures/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xmlfeatures/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #8180 +/- ##
============================================
+ Coverage 52.77% 52.81% +0.03%
+ Complexity 21216 21178 -38
============================================
Files 2197 2197
Lines 130819 130615 -204
Branches 19654 19622 -32
============================================
- Hits 69040 68978 -62
+ Misses 53364 53241 -123
+ Partials 8415 8396 -19
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
1 participant
Proposed changes in this pull request
Add API resource definitions and access control configurations for the Consent Management V2 Consents API.
internal_consent_mgt_consent_view,internal_consent_mgt_consent_create, andinternal_consent_mgt_consent_updatescopes for tenant-level access insystem-api-resource.xml and system-api-resource.xml.j2
internal_org_consent_mgt_consent_view,internal_org_consent_mgt_consent_create, andinternal_org_consent_mgt_consent_updatescopes for organization-level accessendpoints (previously unsecured)
When should this PR be merged
This PR should be merged after the corresponding Consent Management V2 API implementation PRs are ready to merge.
Follow up actions
Developer Checklist (Mandatory)
product-isissue to track any behavioral change or migration impact.Checklist (for reviewing)
General
Functionality
Code
Tests
Security
Documentation