feat(auth): implement RBAC hierarchy, permissions matrix, and auth integration tests - #3
Merged
Merged
Conversation
…state verification
…o-end auth integration test
There was a problem hiding this comment.
🟡 Not ready to approve
Security-sensitive auth code currently includes unsafe fallbacks/panics (hardcoded JWT secret fallback, embedded DB credentials default, and unwrap/expect in constructors).
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
This PR expands the auth crate with RBAC roles, a permissions matrix, OAuth client helpers, JWT enhancements, and adds auth-focused tests, while also applying formatting-only refactors across several crates.
Changes:
- Added RBAC roles + permission matrix helpers (
Role,Permission,role_has_permission, etc.). - Implemented OAuth helpers (GitHub/Google clients, OAuth state) and an Axum auth extractor (
AuthUser). - Added auth unit/integration tests and minor formatting-only updates across the workspace.
File summaries
| File | Description |
|---|---|
| shared/src/lib.rs | Formatting-only change to format_slug for readability. |
| crates/storage/src/lib.rs | Formatting-only change to URL formatting. |
| crates/resume/src/export.rs | Formatting-only change to HTML export match arm. |
| crates/resume/src/builder.rs | Formatting-only change to builder signature and skills list. |
| crates/notification/src/lib.rs | Formatting-only change to tracing::info! invocation. |
| crates/interview/src/lib.rs | Formatting-only change to format! and vector literals. |
| crates/github/src/repositories.rs | Reformatted GithubRepoClient::new (still panics on build failure). |
| crates/common/src/config.rs | Reformatted DATABASE_URL fallback (still embeds credential-like default). |
| crates/auth/tests/integration_tests.rs | Added end-to-end style auth integration test exercising hashing/JWT/OAuth/RBAC. |
| crates/auth/src/refresh_tokens.rs | Added unit tests for refresh token format and uniqueness. |
| crates/auth/src/rbac.rs | Added RBAC role parsing helpers + role hierarchy checks + tests. |
| crates/auth/src/permissions.rs | Added permission enum, role-to-permissions mapping, and tests. |
| crates/auth/src/passwords.rs | Introduced password hashing/verification module + tests. |
| crates/auth/src/oauth/state.rs | Added OAuth state generation/verification + tests. |
| crates/auth/src/oauth/mod.rs | Introduced oauth module surface + provider validation. |
| crates/auth/src/oauth/google.rs | Added Google OAuth authorization URL helper + tests. |
| crates/auth/src/oauth/github.rs | Added GitHub OAuth URL helper + token exchange/profile fetch logic + tests. |
| crates/auth/src/oauth/callback.rs | Added OAuth callback/query and session result DTOs. |
| crates/auth/src/oauth.rs | Removed old provider validation (replaced by oauth module). |
| crates/auth/src/middleware.rs | Added Axum extractor for JWT-authenticated user. |
| crates/auth/src/lib.rs | Re-exported new auth modules; added create_jwt_with_ttl. |
| crates/auth/src/jwt.rs | Added iat, TTL-capable JWT creation, and tests. |
| crates/auth/Cargo.toml | Added workspace deps for reqwest and urlencoding. |
| crates/ats/src/lib.rs | Formatting-only change to keyword match list. |
| crates/ai/src/rag.rs | Formatting-only change to format! usage. |
| crates/ai/src/provider.rs | Formatting-only change to format! usage. |
| crates/ai/src/lib.rs | Formatting-only change to pub use list. |
| Cargo.toml | Added urlencoding to workspace dependencies. |
| Cargo.lock | Updated lockfile for new dependencies (reqwest/urlencoding). |
| apps/api/src/routes.rs | Removed blank lines (formatting-only). |
Review details
- Files reviewed: 29/30 changed files
- Comments generated: 4
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
Comment on lines
+29
to
32
| let expiration = now | ||
| .checked_add_signed(ttl) | ||
| .expect("valid timestamp") | ||
| .timestamp() as usize; |
Comment on lines
+55
to
+57
| let jwt_secret = std::env::var("JWT_SECRET") | ||
| .unwrap_or_else(|_| "devresume_jwt_secret_key_32_chars_min".to_string()); | ||
|
|
Comment on lines
24
to
30
| pub fn new() -> Self { | ||
| Self { | ||
| client: Client::builder().user_agent("DevResume-AI").build().unwrap(), | ||
| client: Client::builder() | ||
| .user_agent("DevResume-AI") | ||
| .build() | ||
| .unwrap(), | ||
| } |
Comment on lines
+20
to
+23
| database_url: env::var("DATABASE_URL").unwrap_or_else(|_| { | ||
| "postgres://devresume_user:devresume_password@localhost:5432/devresume_db" | ||
| .to_string() | ||
| }), |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related Issue
Closes #
Type of Change
feat— New featurefix— Bug fixrefactor— Refactoring (no functional change)docs— Documentation onlytest— Tests onlychore— Build, CI, dependenciesPre-Merge Checklist
Quality Gates
cargo fmt --checkpassescargo clippy -- -D warningspasses (zero warnings)cargo checkpassescargo testpasses (all tests green)Implementation
.unwrap()or.expect()in production code pathstracing::info!/tracing::error!)thiserrorenum)Tests
Documentation
docs/updated if API surface changeddocs/AI/API_CHECKLIST.mdupdated (mark endpoints ✅)docs/FEATURES.mdupdated (mark feature ✅)Architecture
docs/AI/ARCHITECTURE_RULES.md)ChamathDilshanC <dilshancolonne123@gmail.com>Architecture Impact
None / [describe impact]
Testing Notes
Screenshots (if UI or API response)
Notes for Reviewer