Add end-user credential management API resource #7633
Conversation
WalkthroughTwo templated XML configuration files are updated to introduce new Credential Management API resources. These additions define credentials endpoints for both organization-scoped and tenant-scoped contexts, each paired with appropriate authorization scopes and access control rules. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (2)
🔇 Additional comments (2)
Tip 📝 Customizable high-level summaries are now available in beta!You can now customize how CodeRabbit generates the high-level summary in your pull requests — including its content, structure, tone, and formatting.
Example instruction:
Note: This feature is currently in beta for Pro-tier users, and pricing will be announced later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
There was a problem hiding this comment.
Pull request overview
This pull request adds API resource definitions and access control rules for end-user credential management at both tenant and organization levels. The changes enable proper authorization for viewing and deleting user credentials through new REST API endpoints.
Key Changes:
- Added two new API resources for credential management (tenant and organization contexts) with view and delete scopes
- Configured access control rules with regex patterns to secure GET and DELETE operations on credential endpoints
- Reused existing
internal_user_mgt_*andinternal_org_user_mgt_*scopes for consistency with SCIM2 user management APIs
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2 | Defines API resources for credential management with view and delete scopes for both tenant and organization contexts |
| features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2 | Adds access control entries to secure credential endpoints with appropriate scope requirements for GET and DELETE methods |
| requiresAuthorization="true" | ||
| description="API representation of the Credential Management API" type="TENANT"> |
There was a problem hiding this comment.
Inconsistent indentation. The requiresAuthorization attribute should align with the name attribute on the previous line, similar to other APIResource elements in this file (e.g., lines 2087, 2101, 2115).
The line currently has excessive spacing (29 spaces) instead of the standard 17 spaces used throughout the file.
| requiresAuthorization="true" | |
| description="API representation of the Credential Management API" type="TENANT"> | |
| requiresAuthorization="true" | |
| description="API representation of the Credential Management API" type="TENANT"> |
| description="View credentials of users in the organization"/> | ||
| <Scope displayName="Delete Credential" name="internal_user_mgt_delete" | ||
| description="Delete credentials of users in the organization"/> |
There was a problem hiding this comment.
The scope description should follow the established pattern for TENANT type APIs. Based on similar APIs in this file (e.g., SCIM2 Users API at lines 772, 774, 776, 778, 780), TENANT type scope descriptions use "in the organization (root)" instead of just "in the organization". This helps distinguish between tenant-level and organization-level scopes.
Suggested: description="View credentials of users in the organization (root)"
| description="View credentials of users in the organization"/> | |
| <Scope displayName="Delete Credential" name="internal_user_mgt_delete" | |
| description="Delete credentials of users in the organization"/> | |
| description="View credentials of users in the organization (root)"/> | |
| <Scope displayName="Delete Credential" name="internal_user_mgt_delete" | |
| description="Delete credentials of users in the organization (root)"/> |
| description="View credentials of users in the organization"/> | ||
| <Scope displayName="Delete Credential" name="internal_user_mgt_delete" | ||
| description="Delete credentials of users in the organization"/> |
There was a problem hiding this comment.
The scope description should follow the established pattern for TENANT type APIs. Based on similar APIs in this file (e.g., SCIM2 Users API at lines 776, 778, 780), TENANT type scope descriptions use "in the organization (root)" instead of just "in the organization". This helps distinguish between tenant-level and organization-level scopes.
Suggested: description="Delete credentials of users in the organization (root)"
| description="View credentials of users in the organization"/> | |
| <Scope displayName="Delete Credential" name="internal_user_mgt_delete" | |
| description="Delete credentials of users in the organization"/> | |
| description="View credentials of users in the organization (root)"/> | |
| <Scope displayName="Delete Credential" name="internal_user_mgt_delete" | |
| description="Delete credentials of users in the organization (root)"/> |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #7633 +/- ##
============================================
+ Coverage 50.02% 50.46% +0.44%
+ Complexity 19784 18903 -881
============================================
Files 2121 2121
Lines 129971 127831 -2140
Branches 27031 26494 -537
============================================
- Hits 65015 64514 -501
+ Misses 56633 55084 -1549
+ Partials 8323 8233 -90
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
1 participant
This pull request introduces new API resource collections and access control definitions for user credential management, both at the tenant and organization levels. The changes add definitions for these APIs, specify their scopes, and update access control rules to ensure proper authorization for viewing, updating, and deleting user credentials.
API Resource Definitions
Added
user_credentialsandorg_user_credentialscollections toapi-resource-collection.xmland its template, specifying relevant scopes for feature, update, delete, create, and read actions. [1] [2]Defined new API resources for user credential management in
system-api-resource.xmland its template, including endpoints and authorization requirements for both tenant and organization contexts. [1] [2]Access Control Updates
resource-access-control-v2.xmland its template to add access control entries for the new user credential management APIs, specifying scope requirements for GET and DELETE methods for both tenant and organization endpoints. [1] [2]### Proposed changes in this pull request[List all changes you want to add here. If you fixed an issue, please
add a reference to that issue as well.]
When should this PR be merged
[Please describe any preconditions that need to be addressed before we
can merge this pull request.]
Follow up actions
[List any possible follow-up actions here; for instance, testing data
migrations, software that we need to install on staging and production
environments.]
Developer Checklist (Mandatory)
product-isissue to track any behavioral change or migration impact.Checklist (for reviewing)
General
Functionality
Code
Tests
Security
Documentation
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.