Add API resources and access control for user share API V2 #7695
Conversation
WalkthroughAdds V2 User Sharing API resource declarations and matching access-control entries for tenant and organization contexts, introducing share, unshare, view, and update scopes and HTTP method mappings for Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In
`@features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml`:
- Around line 1796-1814: The PATCH Resource mapping currently uses the non-org
context "(.*)/api/server/v2/users/share(.*)" causing scope collision; modify the
Resource element with http-method="PATCH" (the one whose <Scopes> is
internal_org_shared_user_access_update) to use the org context
"(.*)/o/api/server/v2/users/share(.*)" so it aligns with the other org endpoints
and avoids applying the org scope to tenant routes.
In
`@features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2`:
- Around line 1979-2017: The org PATCH Resource currently maps the org scope to
the tenant path (/api/server/v2/users/share) causing a duplicate tenant PATCH
entry and scope mismatch; update the Resource with http-method="PATCH" that uses
scope internal_org_shared_user_access_update so its context is
"(.*)/o/api/server/v2/users/share(.*)" (matching the org pattern) instead of
"(.*)/api/server/v2/users/share(.*)" so the org PATCH maps to the /o/api/...
path and aligns with internal_org_shared_user_access_update.
...y-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml
Show resolved
Hide resolved
...ore/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2
Show resolved
Hide resolved
There was a problem hiding this comment.
Pull request overview
Adds system API resource definitions and resource-access-control mappings to secure User Sharing API v2 operations in both tenant and organization contexts with explicit scopes.
Changes:
- Added new v2 scopes for share/unshare/view/update operations under tenant and organization API resources.
- Added resource-access-control mappings for v2 user sharing endpoints and HTTP methods.
- Updated both template (
.j2) and generated XML files to keep configurations aligned.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2 | Adds v2 user sharing endpoint-to-scope mappings (template). |
| features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml | Adds v2 user sharing endpoint-to-scope mappings (generated XML). |
| features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2 | Defines tenant/org API resources and new v2 scopes (template). |
| features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml | Defines tenant/org API resources and new v2 scopes (generated XML). |
...y-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml
Show resolved
Hide resolved
...ore/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2
Show resolved
Hide resolved
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #7695 +/- ##
============================================
- Coverage 51.26% 51.07% -0.19%
- Complexity 19363 19679 +316
============================================
Files 2144 2144
Lines 123096 128180 +5084
Branches 26224 27489 +1265
============================================
+ Hits 63103 65471 +2368
- Misses 51889 54371 +2482
- Partials 8104 8338 +234
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| requiresAuthorization="true" | ||
| description="API representation of the user share API V2" type="TENANT"> | ||
| <Scopes> | ||
| <Scope displayName="Share Users" name="internal_share_user" |
There was a problem hiding this comment.
Using a new scope for the same purpose will be confusing for users and also it will grow the number of internal scopes unnecessarily (which is a concern right now as well).
@piraveena AFAIR, we decided that it is okay to share the internal scopes between APIs during Scim2 Roles V3 API implementation. Will it be okay to use similar approach here as well?
|
2 participants
Purpose
This PR adds the system API resource definitions and access control mappings required for User Sharing API v2, covering both tenant-level and organization-level contexts. It ensures that all v2 user sharing operations are protected by explicitly defined scopes and enforced consistently through the resource-access-control layer.
Goals
Approach
/api/server/v2/users)/o/api/server/v2/users)resource-access-control-v2.xmlRelated PRs
NOTE
Related Issue
Summary by CodeRabbit