feat(api): register portal-assistant:invoke and add chart roles validation test (#4683) by kavix · Pull Request #4722 · openchoreo/openchoreo

kavix · 2026-09-11T22:29:34Z

Purpose

Resolves #4683 (codebase portion).

During the authorization audit in #4683, portal-assistant:invoke was found to be granted to platform-engineer and developer roles in Helm chart values (install/helm/openchoreo-control-plane/values.yaml), and actively enforced by AuthRuntime in agents/portal-assistant/src/auth.py and agent_routes.py. However, it was missing from the registry in internal/authz/core/actions.go.

This PR formally registers ActionInvokePortalAssistant and introduces an automated drift-guard test to prevent future divergence between Helm bootstrap roles and the core action registry.

Approach

Registered ActionInvokePortalAssistant = "portal-assistant:invoke" in internal/authz/core/actions.go with lowest scope ScopeCluster and IsInternal: false.
Added internal/authz/core/chart_roles_test.go (TestBootstrapRoles_ActionValidity) which parses install/helm/openchoreo-control-plane/values.yaml and validates that every action granted across all bootstrap roles exists in core.ConcretePublicActions().

Related Issues

Checklist

Tests added or updated (unit, integration, etc.)
Samples updated (if applicable)
Added backport/<release-branch> label if this should be backported (e.g., backport/release-v1.0)
This PR includes AI-generated code or content

Remarks

Documentation updates bringing the 165 actions and 11 default roles up to date are submitted in companion PR: openchoreo/openchoreo.github.io#857

coderabbitai · 2026-09-11T22:30:34Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 6bfb7afd-2e7d-4e95-a50a-6a4ebc7e404e

📥 Commits

Reviewing files that changed from the base of the PR and between 98e6e07 and 2f2b51f.

📒 Files selected for processing (1)

internal/authz/core/actions_test.go

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📝 Summary

Summary

Added portal-assistant:invoke to the public authorization registry.
Set its lowest scope to ScopeCluster.
Set IsInternal to false.
Added validation for Helm bootstrap role grants.

Changed files

Top-level folder	Files
`internal/`	2
`api/`, `config/`, `pkg/`, `install/`, `docs/`, `openapi/`, `agents/`, `make/`, `cmd/`, `samples/`	0

API/CRD surface

No API or CRD changes.
Compatibility risk: Low.
The change adds one public authorization action and does not remove or alter existing actions.

Tests

Added TestActionInvokePortalAssistantRegistered.
- Checks the action name.
- Checks public registration.
- Checks ScopeCluster.
- Checks IsInternal: false.
Added TestBootstrapRoles_ActionValidity.
- Loads install/helm/openchoreo-control-plane/values.yaml.
- Checks that bootstrap roles exist and contain actions.
- Rejects grants that are not in core.ConcretePublicActions().
- Allows the * wildcard.
No test execution result was supplied.
No evidence was provided for end-to-end Portal Assistant authorization tests or Helm installation tests.

Risk hotspots

Authorization/RBAC: Medium. Bootstrap roles now receive validation against the registered public action set. An invalid grant can fail the test.
Portal Assistant authorization: Low to medium. The action is now registered with cluster scope and public visibility. Runtime endpoint enforcement is not covered by the supplied tests.
Secrets: No changes identified.
Reconciliation loops: No changes identified.
Install/upgrade paths: Low. The test reads the control-plane Helm values file, but no install or upgrade execution result was supplied.

Review finding severity counts: unavailable from the supplied evidence.

Walkthrough

The authorization registry adds portal-assistant:invoke as a public, cluster-scoped action. Tests verify its registration and validate bootstrap role actions against concrete public actions.

Changes

Portal assistant authorization

Layer / File(s)	Summary
Register portal assistant action `internal/authz/core/actions.go`, `internal/authz/core/actions_test.go`	Adds the `portal-assistant:invoke` constant and registers it as a public cluster-scoped system action. The registration test verifies its name, scope, and visibility.
Validate bootstrap role actions `internal/authz/core/actions_test.go`, `helm/.../values.yaml`	Adds YAML-backed validation that bootstrap roles contain actions and reference concrete public actions, while allowing `*`.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Merge Risk: ⚪ Minimal · up to 2f2b5

The portal assistant permission is registered as a public cluster-scoped action, and bootstrap-role configuration is checked against the action registry. No merge-blocking risk was identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description includes the required Purpose, Approach, Related Issues, Checklist, and Remarks sections. It clearly explains the action registration and drift-guard test. The checklist records the ad…
Title check	✅ Passed	The title uses Conventional Commits format and clearly identifies the main changes: registering portal-assistant:invoke and adding chart role validation.
Linked Issues check	✅ Passed	Issue `#4683` requires resolving the unregistered `portal-assistant:invoke` grant. The PR defines `ActionInvokePortalAssistant` and registers it as a public action with `ScopeCluster` and `IsInternal: f…
Out of Scope Changes check	✅ Passed	The changes add the required authorization registry entry and tests that protect the registry and Helm bootstrap-role alignment. The changes support the coding objectives in `#4683`. No unrelated change…

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-09-11T22:49:01Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

mevan-karu · 2026-09-17T11:29:51Z

@kavix There are some conflicts. Can you resolve those and push again?

kavix · 2026-09-17T12:35:53Z

@mevan-karu Done!

yashodgayashan · 2026-09-18T04:48:50Z

Any reason for the file name? We have to have files for code and the test which follows name_test.go.

Moved into actions_test.go to match convention and removed chart_roles_test.go.

…ation test (openchoreo#4683) Signed-off-by: Kavindu Sachinthe <[email protected]>

savisaluwadana · 2026-10-01T08:53:51Z

Hi @LakshanSS can you look into this thank you

kavix requested review from ChathurangaKCD, JanakaSandaruwan, Ketharan, LakshanSS, Mirage20, NomadXD, VajiraPrabuddhaka, akila-i, chathuranga95, isala404, mevan-karu, nilushancosta, sameerajayasoma and yashodgayashan as code owners September 11, 2026 22:29

github-actions Bot added the reportedBy/community label Sep 11, 2026

kavix mentioned this pull request Sep 11, 2026

docs(authz): update available actions and default roles (#4683) openchoreo/openchoreo.github.io#857

Open

2 of 4 tasks

kavix force-pushed the fix-authz-docs-action-lists-4683 branch from 5de73a3 to fa658c7 Compare September 11, 2026 22:39

kavix changed the title ~~feat(authz): register portal-assistant:invoke and add chart roles validation test (#4683)~~ feat(api): register portal-assistant:invoke and add chart roles validation test (#4683) Sep 11, 2026

mevan-karu previously approved these changes Sep 14, 2026

View reviewed changes

kavix dismissed mevan-karu’s stale review via 98e6e07 September 17, 2026 12:34

kavix force-pushed the fix-authz-docs-action-lists-4683 branch from fa658c7 to 98e6e07 Compare September 17, 2026 12:34

kavix requested a review from mevan-karu September 17, 2026 12:39

yashodgayashan reviewed Sep 18, 2026

View reviewed changes

feat(api): register portal-assistant:invoke and add chart roles valid…

2f2b51f

…ation test (openchoreo#4683) Signed-off-by: Kavindu Sachinthe <[email protected]>

kavix force-pushed the fix-authz-docs-action-lists-4683 branch from 98e6e07 to 2f2b51f Compare September 18, 2026 05:03

kavix requested a review from yashodgayashan September 18, 2026 05:06

chathuranga95 approved these changes Oct 1, 2026

View reviewed changes

Navigation Menu

feat(api): register portal-assistant:invoke and add chart roles validation test (#4683) - #4722

feat(api): register portal-assistant:invoke and add chart roles validation test (#4683)#4722
kavix wants to merge 1 commit into
openchoreo:mainfrom
kavix:fix-authz-docs-action-lists-4683

kavix commented Sep 11, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 11, 2026 •

edited

Loading

Reviews paused

Summary

Changed files

API/CRD surface

Tests

Risk hotspots

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

codecov Bot commented Sep 11, 2026

Uh oh!

mevan-karu commented Sep 17, 2026

Uh oh!

kavix commented Sep 17, 2026

Uh oh!

yashodgayashan Sep 18, 2026

Uh oh!

kavix Sep 18, 2026

Uh oh!

savisaluwadana commented Oct 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

kavix commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Approach

Related Issues

Checklist

Remarks

Uh oh!

coderabbitai Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Summary

Changed files

API/CRD surface

Tests

Risk hotspots

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

codecov Bot commented Sep 11, 2026

Codecov Report

Uh oh!

mevan-karu commented Sep 17, 2026

Uh oh!

kavix commented Sep 17, 2026

Uh oh!

yashodgayashan Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

kavix Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

savisaluwadana commented Oct 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

kavix commented Sep 11, 2026 •

edited

Loading

coderabbitai Bot commented Sep 11, 2026 •

edited

Loading