[DevPortal] Restructure authentication & authorization configuration - #3045
Merged
Conversation
Piumal1999
requested review from
AnuGayan,
Arshardh,
CrowleyRajapakse,
HeshanSudarshana,
HiranyaKavishani,
Induwara04,
Krishanx92,
PasanT9,
RakhithaRR,
Tharsanan1,
Thushani-Jayasekera,
VirajSalaka,
ashera96,
chamilaadhi,
dushaniw,
hisanhunais,
lasanthaS,
malinthaprasan,
pubudu538,
renuka-fernando,
senthuran16,
tgtshanika,
tharikaGitHub,
tharindu1st and
thivindu
as code owners
July 30, 2026 17:06
Contributor
📝 WalkthroughWalkthroughThe PR replaces legacy role validation with centralized authorization settings, adds validated role-to-scope expansion, updates authentication and page-tier enforcement, stages component-specific mapping files, aligns scopes and Helm configuration, and revises related documentation. ChangesAuthorization configuration and grant validation
Runtime scope and page authorization
Deployment, packaging, and scope definitions
Configuration and administration documentation
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant authMiddleware
participant authorization
participant roleScopeMap
Client->>authMiddleware: send authenticated request
authMiddleware->>authorization: compute effective scopes
authorization->>roleScopeMap: expand token roles
roleScopeMap-->>authorization: return granted scopes
authorization-->>authMiddleware: return authorization context
authMiddleware-->>Client: allow or reject request
Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
|
@coderabbitai review |
Contributor
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@portals/api-portal/distribution/README.md`:
- Around line 128-132: The authorization configuration table in the README must
match runtime defaults: change the mode default to role, document the default
role-to-scope mapping path instead of an empty value, and update portal_roles to
list only the admin and subscriber tiers, removing super_admin and any
unsupported default tier.
In `@portals/api-portal/docs/administer/asgardeo-setup.md`:
- Around line 107-117: Update the enclosing TOML table from [idp] to
[api_portal.auth.idp] in both
portals/api-portal/docs/administer/asgardeo-setup.md lines 107-117 and
portals/api-portal/docs/administer/authentication.md lines 267-279, leaving the
nested IDP settings unchanged.
In `@portals/api-portal/README.md`:
- Around line 289-292: Update the earlier configuration statement in the README
to remove the claim that every setting supports an APIP_AP_* override; state
instead that overrides apply only to settings whose config.toml entries
explicitly reference the corresponding environment variable, consistent with the
documented templating behavior.
- Around line 258-270: Update the role authorization documentation around the
local auth and role-mode mapping table to state that local role-mode
authorization requires both Platform API’s and the portal’s role-to-scope
mappings. Clarify that Platform API expands roles when issuing the token, while
the portal expands incoming roles when authorization.mode is "role", so
operators must update the relevant entries in both files to change portal
permissions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 98f9c2e2-81db-406e-b5e9-aff90662b810
📒 Files selected for processing (29)
kubernetes/helm/developer-portal-helm-chart/values-local.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/configmap.yamlkubernetes/helm/developer-portal-ui-helm-chart/values-local.yamlkubernetes/helm/developer-portal-ui-helm-chart/values.yamlportals/api-portal/Makefileportals/api-portal/README.mdportals/api-portal/configs/config-template.tomlportals/api-portal/configs/config.tomlportals/api-portal/distribution/README.mdportals/api-portal/docker-compose.yamlportals/api-portal/docs/README.mdportals/api-portal/docs/administer/asgardeo-setup.mdportals/api-portal/docs/administer/authentication.mdportals/api-portal/it/configs/roles-platform-api-it.yamlportals/api-portal/it/test-config.tomlportals/api-portal/production/scripts/register_asgardeo_scopes.shportals/api-portal/resources/role-to-scope-mapping.yamlportals/api-portal/src/config/authorizationConfig.test.jsportals/api-portal/src/config/configDefaults.jsportals/api-portal/src/config/configLoader.jsportals/api-portal/src/config/roleScopeMap.jsportals/api-portal/src/config/roleScopeMap.test.jsportals/api-portal/src/controllers/authController.jsportals/api-portal/src/middlewares/authMiddleware.jsportals/api-portal/src/middlewares/authorization.jsportals/api-portal/src/middlewares/ensureAuthenticated.jsportals/api-portal/src/middlewares/passportConfig.jsportals/api-portal/src/utils/constants.jsportals/api-portal/src/utils/jwtDecode.js
💤 Files with no reviewable changes (1)
- portals/api-portal/src/utils/constants.js
Thushani-Jayasekera
approved these changes
Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Update the authentication, authorization functionalities according to platform API
Summary
TBD
Approach
TBD
Related PRs
#3022