Skip to content

test(intelligent-assistant-backend): add RBAC permission integration tests - #4693

Merged
HusneShabbir merged 1 commit into
redhat-developer:mainfrom
HusneShabbir:test/ia-rbac-backend-permissions-integration
Sep 11, 2026
Merged

HusneShabbir merged 1 commit into
redhat-developer:mainfrom
HusneShabbir:test/ia-rbac-backend-permissions-integration

Conversation

@HusneShabbir

@HusneShabbir HusneShabbir commented Sep 10, 2026

Copy link
Copy Markdown
Member

Summary

Follow-up integration test coverage for #4612 (consolidated IA RBAC permissions).

  • Add rbacPermissions.test.ts with permission name contract tests for all four feature-linked sets (chat, notebooks, mcp.tools, skills)
  • Add selective allow/deny tests to catch mis-wired route guards (e.g. chat allowed but MCP denied)
  • Assert permission integration metadata exposes all four iaPermissions
  • Add missing 403 test for GET /notebook-conversation-ids
  • Add notebooks router permission name contract for POST /v1/sessions

Fixes RHIDP-15748(test gap from #4612)

Test plan

  • yarn test src/service/rbacPermissions.test.ts — 9/9 pass
  • yarn test src/service/router.test.ts -t "notebook-conversation-ids" — 3/3 pass
  • yarn test src/service/notebooks/notebooksRouter.test.ts -t "RBAC" — 1/1 pass

…tests

Follow-up to redhat-developer#4612 — lock in consolidated permission names on backend
routes with authorize() contract tests, selective allow/deny coverage,
permission metadata registration, and a missing 403 for notebook-conversation-ids.

Assisted-by: Cursor
Co-authored-by: Cursor <cursoragent@cursor.com>
@sonarqubecloud

Copy link
Copy Markdown

@codecov

codecov Bot commented Sep 10, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.60%. Comparing base (f6cd19a) to head (2186afd).
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #4693   +/-   ##
=======================================
  Coverage   62.60%   62.60%           
=======================================
  Files        2635     2635           
  Lines      105191   105191           
  Branches    29501    29514   +13     
=======================================
  Hits        65859    65859           
  Misses      37478    37478           
  Partials     1854     1854           
Flag Coverage Δ *Carryforward flag
adoption-insights 84.77% <ø> (ø) Carriedforward from f6cd19a
ai-integrations 78.80% <ø> (ø) Carriedforward from f6cd19a
app-defaults 53.07% <ø> (ø) Carriedforward from f6cd19a
augment 46.67% <ø> (ø) Carriedforward from f6cd19a
boost 82.94% <ø> (ø) Carriedforward from f6cd19a
bulk-import 73.12% <ø> (ø) Carriedforward from f6cd19a
cost-management 13.35% <ø> (ø) Carriedforward from f6cd19a
dcm 73.47% <ø> (ø) Carriedforward from f6cd19a
e2e-adoption-insights 60.00% <ø> (ø) Carriedforward from f6cd19a
e2e-extensions 62.31% <ø> (ø) Carriedforward from f6cd19a
e2e-global-header 49.71% <ø> (ø) Carriedforward from f6cd19a
e2e-homepage 61.11% <ø> (ø) Carriedforward from f6cd19a
e2e-intelligent-assistant 46.74% <ø> (ø) Carriedforward from f6cd19a
e2e-orchestrator 49.52% <ø> (ø) Carriedforward from f6cd19a
e2e-orchestrator-plugin 49.51% <ø> (ø) Carriedforward from f6cd19a
e2e-quickstart 55.21% <ø> (ø) Carriedforward from f6cd19a
e2e-scorecard 50.05% <ø> (ø) Carriedforward from f6cd19a
e2e-theme 16.36% <ø> (ø) Carriedforward from f6cd19a
extensions 57.37% <ø> (ø) Carriedforward from f6cd19a
global-floating-action-button 71.18% <ø> (ø) Carriedforward from f6cd19a
global-header 67.88% <ø> (ø) Carriedforward from f6cd19a
homepage 48.48% <ø> (ø) Carriedforward from f6cd19a
install-dynamic-plugins 71.94% <ø> (ø) Carriedforward from f6cd19a
intelligent-assistant 76.51% <ø> (ø)
konflux 91.98% <ø> (ø) Carriedforward from f6cd19a
lightspeed 69.02% <ø> (ø) Carriedforward from f6cd19a
mcp-integrations 84.46% <ø> (ø) Carriedforward from f6cd19a
orchestrator 72.02% <ø> (ø) Carriedforward from f6cd19a
quickstart 63.74% <ø> (ø) Carriedforward from f6cd19a
sandbox 79.56% <ø> (ø) Carriedforward from f6cd19a
scorecard 88.20% <ø> (ø) Carriedforward from f6cd19a
theme 87.91% <ø> (ø) Carriedforward from f6cd19a
translations 5.12% <ø> (ø) Carriedforward from f6cd19a
x2a 77.18% <ø> (ø) Carriedforward from f6cd19a

*This pull request uses carry forward flags. Click here to find out more.


Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f6cd19a...2186afd. Read the comment docs.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@Jdubrick

Copy link
Copy Markdown
Contributor

/fs-review

@fullsend-ai-review

fullsend-ai-review Bot commented Sep 10, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 7:47 PM UTC · Completed 7:52 PM UTC

Commit: 2186afd · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $1.13

@fullsend-ai-review

Copy link
Copy Markdown

Review — approve

Summary

Test-only PR adding RBAC permission integration tests for the intelligent-assistant-backend plugin, closing a test gap from #4612 (consolidated IA RBAC permissions). Three test files are touched — one new (rbacPermissions.test.ts, 335 lines), two extended — totalling +401 / −0 lines. No production code is modified.

What was checked

Correctness

  • Each permission name contract test (GET /v1/modelsiaChatPermission, GET /notebook-conversation-idsiaNotebooksPermission, GET /mcp-serversiaMcpToolsPermission, GET /v1/skillsiaSkillsPermission, POST /v1/sessionsiaNotebooksPermission) was verified against the route definitions in router.ts (lines 606, 563, 315, 662) and notebooksRouters.ts (line 277). All assertions match.
  • The selectiveAuthorize helper correctly returns ALLOW only for the target permission's name, and DENY for all others — confirming cross-permission isolation.
  • The metadata test asserts iaPermissions.length against the response, which will automatically catch regressions if a fifth permission is added without updating the test.
  • The new 403 test for GET /notebook-conversation-ids follows the existing startBackendServer(config, AuthorizeResult.DENY) pattern in router.test.ts.

Security

  • No security concerns. The PR is purely test code and improves the security posture by verifying RBAC enforcement.

Intent & coherence

Style & conventions

  • Test structure, fixtures, setupServer/msw patterns, and license headers are consistent with the existing test files (router.test.ts, notebooksRouter.test.ts).

Documentation currency

  • No documentation impact — test-only change.

Findings

[low · style] Inconsistent mockUserId format across test files
rbacPermissions.test.ts uses 'user:default/user1' (no space), while router.test.ts uses 'user: default/user1' (space after colon). Both are treated as opaque string identifiers in mock contexts and do not affect correctness, but the inconsistency could cause confusion during future refactors.
File: workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/src/service/rbacPermissions.test.ts, line 50
Remediation: Align with the existing convention in router.test.ts (with space) or standardize across all test files.

Verdict

Approve — well-structured, correctly-wired integration tests that directly verify the RBAC permission contracts introduced in #4612. The single low-severity finding is cosmetic and non-blocking.

@fullsend-ai-review fullsend-ai-review Bot added the ready-for-merge All reviewers approved — ready to merge label Sep 10, 2026

@Jdubrick Jdubrick left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@michael-valdron michael-valdron left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@HusneShabbir
HusneShabbir enabled auto-merge (squash) September 11, 2026 05:18
@HusneShabbir
HusneShabbir merged commit 5d07cdf into redhat-developer:main Sep 11, 2026
46 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ready-for-merge All reviewers approved — ready to merge workspace/intelligent-assistant

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants