Authorize knowledge uploads by Knowledge Space - #11
Conversation
|
Warning Review limit reached
Next review available in: 37 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughAdds Knowledge Spaces with OpenFGA-based upload authorization, persists space identity through source ingestion and publication, adds authorization-aware source listing, updates upload UI/API flows, and documents related ACL and retrieval behavior. ChangesKnowledge Space security flow
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant SourceUploadDialog
participant SourceController
participant SourceUploadService
participant KnowledgeSpaceService
participant ObjectStoragePort
participant Worker
participant OpenFGA
User->>SourceUploadDialog: Select Knowledge Space and file
SourceUploadDialog->>SourceController: Submit upload with knowledgeSpaceId
SourceController->>SourceUploadService: CreateUploadSourceCommand
SourceUploadService->>KnowledgeSpaceService: Recheck can_create_asset
KnowledgeSpaceService->>OpenFGA: Check selected Knowledge Space
OpenFGA-->>KnowledgeSpaceService: Authorization decision
SourceUploadService->>ObjectStoragePort: Write authorized upload
Worker->>OpenFGA: Publish space and owner relationships
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@apps/api/src/test/java/com/orgmemory/api/source/SourceUploadIntegrationTests.java`:
- Around line 80-90: Update the stubbing in the upload test around
uploads.upload and knowledgeSpaces.requireUploadTarget to match ACTOR and
SALES_SPACE_ID explicitly instead of accepting any values. Add assertions that
the persisted source contains the expected knowledge_space_id and department_id
from the resolved KnowledgeSpaceTarget.
In
`@apps/worker/src/test/java/com/orgmemory/worker/ingestion/SourceIngestionPipelineIntegrationTests.java`:
- Around line 237-246: Update the assertions in
SourceIngestionPipelineIntegrationTests around writeRequest to also verify that
the Space tuple’s object equals "knowledge_asset:" plus
revision.get("knowledge_asset_id"), while preserving the existing principal and
relation checks and the separate user-owner tuple assertions.
In
`@core/src/main/resources/db/migration/V18__knowledge_space_upload_authorization.sql`:
- Around line 77-102: Make the V18 migration online-safe by using an explicitly
non-transactional expand/backfill/validate rollout for source_objects and the
affected asset tables: add nullable columns with NOT VALID foreign keys, perform
bounded batch backfills, then validate and finalize constraints without
immediate blocking checks. Build indexes on populated existing tables
concurrently, preserving tenant-scoped foreign keys, uniqueness, and append-only
evidence semantics while remaining compatible with PostgreSQL 18 and pgvector.
In `@integrations/authorization-openfga/src/test/openfga/store.fga.yaml`:
- Around line 167-200: Add a negative direct check for user:minh on
knowledge_space:company with can_create_asset set to false in the “Upload
targets are authorized on the parent Knowledge Space” test case. Keep the
existing finance check and empty list_objects assertion unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: b77d6a2f-bd81-441b-aa79-47754a45796e
⛔ Files ignored due to path filters (2)
contracts/openapi.jsonis excluded by!contracts/openapi.jsonintegrations/authorization-openfga/src/main/openfga/local-demo-tuples.csvis excluded by!**/*.csv
📒 Files selected for processing (40)
ARCHITECTURE.mdapps/api/src/main/java/com/orgmemory/api/ApiExceptionHandler.javaapps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeSpaceController.javaapps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeSpaceResponse.javaapps/api/src/main/java/com/orgmemory/api/source/SourceController.javaapps/api/src/test/java/com/orgmemory/api/knowledge/KnowledgeIngestionIntegrationTests.javaapps/api/src/test/java/com/orgmemory/api/source/SourceUploadIntegrationTests.javaapps/worker/src/main/java/com/orgmemory/worker/ingestion/SourceIngestionProcessor.javaapps/worker/src/test/java/com/orgmemory/worker/ingestion/SourceIngestionPipelineIntegrationTests.javacore/src/main/java/com/orgmemory/core/knowledge/ClaimedSourceRevision.javacore/src/main/java/com/orgmemory/core/knowledge/CreateUploadSourceCommand.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAsset.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationCoordinator.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationOutbox.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationService.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationState.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeIngestionService.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpace.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceRepository.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceService.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceTarget.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceUnavailableException.javacore/src/main/java/com/orgmemory/core/knowledge/PromoteNormalizedRecordCommand.javacore/src/main/java/com/orgmemory/core/knowledge/PublishKnowledgeAssetCommand.javacore/src/main/java/com/orgmemory/core/knowledge/SourceIngestionCoordinator.javacore/src/main/java/com/orgmemory/core/knowledge/SourceObject.javacore/src/main/java/com/orgmemory/core/knowledge/SourceRevision.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadRegistrationService.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadService.javacore/src/main/resources/db/migration/V18__knowledge_space_upload_authorization.sqlcore/src/test/java/com/orgmemory/core/knowledge/KnowledgeSpaceServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/SourceUploadServiceTests.javadocs/increments/active/2026-07-22-secure-hybrid-retrieval/plan.mddocs/roadmap.mddocs/specs/domains/knowledge-ingestion.mdintegrations/authorization-openfga/src/test/openfga/store.fga.yamlweb/src/features/session/csrf-fetch.tsweb/src/features/sources/api/upload-source.tsweb/src/features/sources/components/source-upload-dialog.tsxweb/src/features/sources/components/sources-page.tsx
📜 Review details
🧰 Additional context used
📓 Path-based instructions (14)
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
**/*: Before changing unfamiliar Spring Boot 4, Spring Modulith 2, Spring AI 2, Gradle, React, Vite, Tailwind, or TypeScript APIs, consult Context7/current official documentation and the projectorgmemory-*verification skills.
Readdocs/guidelines/agent-safety.mdbefore retrieval, AI, MCP, permission, upload, graph, or export work.
Never commit.envfiles, provider keys, tokens, or customer data.
Run the relevant gates fromdocs/guidelines/testing-harness.md; use a terminating clean test as the context gate, and do not treatbootRunas verification.
Current behavior belongs in architecture/specs only after it exists in code; intent belongs in vision, roadmap, or an active increment, and repository state must not be duplicated across documents.
Files:
core/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceTarget.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceUnavailableException.javaapps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeSpaceResponse.javadocs/increments/active/2026-07-22-secure-hybrid-retrieval/plan.mdcore/src/main/java/com/orgmemory/core/knowledge/ClaimedSourceRevision.javacore/src/test/java/com/orgmemory/core/knowledge/SourceUploadServiceTests.javacore/src/main/java/com/orgmemory/core/knowledge/PromoteNormalizedRecordCommand.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpace.javacore/src/main/java/com/orgmemory/core/knowledge/PublishKnowledgeAssetCommand.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceRepository.javacore/src/main/java/com/orgmemory/core/knowledge/SourceIngestionCoordinator.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationState.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationCoordinator.javaapps/api/src/main/java/com/orgmemory/api/ApiExceptionHandler.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationService.javaapps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeSpaceController.javaweb/src/features/sources/api/upload-source.tsapps/api/src/main/java/com/orgmemory/api/source/SourceController.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationOutbox.javacore/src/main/java/com/orgmemory/core/knowledge/SourceRevision.javaweb/src/features/session/csrf-fetch.tscore/src/main/resources/db/migration/V18__knowledge_space_upload_authorization.sqlintegrations/authorization-openfga/src/test/openfga/store.fga.yamlcore/src/main/java/com/orgmemory/core/knowledge/CreateUploadSourceCommand.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeIngestionService.javacore/src/main/java/com/orgmemory/core/knowledge/SourceObject.javacore/src/test/java/com/orgmemory/core/knowledge/KnowledgeSpaceServiceTests.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAsset.javadocs/roadmap.mdcore/src/main/java/com/orgmemory/core/knowledge/SourceUploadRegistrationService.javaapps/worker/src/main/java/com/orgmemory/worker/ingestion/SourceIngestionProcessor.javaapps/api/src/test/java/com/orgmemory/api/knowledge/KnowledgeIngestionIntegrationTests.javadocs/specs/domains/knowledge-ingestion.mdweb/src/features/sources/components/source-upload-dialog.tsxweb/src/features/sources/components/sources-page.tsxapps/worker/src/test/java/com/orgmemory/worker/ingestion/SourceIngestionPipelineIntegrationTests.javaapps/api/src/test/java/com/orgmemory/api/source/SourceUploadIntegrationTests.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadService.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceService.javaARCHITECTURE.md
**/*.{java,sql}
📄 CodeRabbit inference engine (CLAUDE.md)
Pair JPA schema changes with a Flyway migration.
Files:
core/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceTarget.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceUnavailableException.javaapps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeSpaceResponse.javacore/src/main/java/com/orgmemory/core/knowledge/ClaimedSourceRevision.javacore/src/test/java/com/orgmemory/core/knowledge/SourceUploadServiceTests.javacore/src/main/java/com/orgmemory/core/knowledge/PromoteNormalizedRecordCommand.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpace.javacore/src/main/java/com/orgmemory/core/knowledge/PublishKnowledgeAssetCommand.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceRepository.javacore/src/main/java/com/orgmemory/core/knowledge/SourceIngestionCoordinator.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationState.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationCoordinator.javaapps/api/src/main/java/com/orgmemory/api/ApiExceptionHandler.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationService.javaapps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeSpaceController.javaapps/api/src/main/java/com/orgmemory/api/source/SourceController.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationOutbox.javacore/src/main/java/com/orgmemory/core/knowledge/SourceRevision.javacore/src/main/resources/db/migration/V18__knowledge_space_upload_authorization.sqlcore/src/main/java/com/orgmemory/core/knowledge/CreateUploadSourceCommand.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeIngestionService.javacore/src/main/java/com/orgmemory/core/knowledge/SourceObject.javacore/src/test/java/com/orgmemory/core/knowledge/KnowledgeSpaceServiceTests.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAsset.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadRegistrationService.javaapps/worker/src/main/java/com/orgmemory/worker/ingestion/SourceIngestionProcessor.javaapps/api/src/test/java/com/orgmemory/api/knowledge/KnowledgeIngestionIntegrationTests.javaapps/worker/src/test/java/com/orgmemory/worker/ingestion/SourceIngestionPipelineIntegrationTests.javaapps/api/src/test/java/com/orgmemory/api/source/SourceUploadIntegrationTests.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadService.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceService.java
**/*.java
📄 CodeRabbit inference engine (CLAUDE.md)
JetBrains IDE inspection is a Java-backend gate only.
Files:
core/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceTarget.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceUnavailableException.javaapps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeSpaceResponse.javacore/src/main/java/com/orgmemory/core/knowledge/ClaimedSourceRevision.javacore/src/test/java/com/orgmemory/core/knowledge/SourceUploadServiceTests.javacore/src/main/java/com/orgmemory/core/knowledge/PromoteNormalizedRecordCommand.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpace.javacore/src/main/java/com/orgmemory/core/knowledge/PublishKnowledgeAssetCommand.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceRepository.javacore/src/main/java/com/orgmemory/core/knowledge/SourceIngestionCoordinator.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationState.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationCoordinator.javaapps/api/src/main/java/com/orgmemory/api/ApiExceptionHandler.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationService.javaapps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeSpaceController.javaapps/api/src/main/java/com/orgmemory/api/source/SourceController.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationOutbox.javacore/src/main/java/com/orgmemory/core/knowledge/SourceRevision.javacore/src/main/java/com/orgmemory/core/knowledge/CreateUploadSourceCommand.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeIngestionService.javacore/src/main/java/com/orgmemory/core/knowledge/SourceObject.javacore/src/test/java/com/orgmemory/core/knowledge/KnowledgeSpaceServiceTests.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAsset.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadRegistrationService.javaapps/worker/src/main/java/com/orgmemory/worker/ingestion/SourceIngestionProcessor.javaapps/api/src/test/java/com/orgmemory/api/knowledge/KnowledgeIngestionIntegrationTests.javaapps/worker/src/test/java/com/orgmemory/worker/ingestion/SourceIngestionPipelineIntegrationTests.javaapps/api/src/test/java/com/orgmemory/api/source/SourceUploadIntegrationTests.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadService.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceService.java
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java
⚙️ CodeRabbit configuration file
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java: Treat PostgreSQL ACL evidence as canonical and OpenFGA as the relationship
authorization decision point. Authorization must fail closed. Filtering
must happen before ranking, LIMIT, graph traversal, answer generation,
export, and citation rendering. Flag metadata or timing leak paths.
Files:
core/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceTarget.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceUnavailableException.javacore/src/main/java/com/orgmemory/core/knowledge/ClaimedSourceRevision.javacore/src/main/java/com/orgmemory/core/knowledge/PromoteNormalizedRecordCommand.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpace.javacore/src/main/java/com/orgmemory/core/knowledge/PublishKnowledgeAssetCommand.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceRepository.javacore/src/main/java/com/orgmemory/core/knowledge/SourceIngestionCoordinator.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationState.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationCoordinator.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationService.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationOutbox.javacore/src/main/java/com/orgmemory/core/knowledge/SourceRevision.javacore/src/main/java/com/orgmemory/core/knowledge/CreateUploadSourceCommand.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeIngestionService.javacore/src/main/java/com/orgmemory/core/knowledge/SourceObject.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeAsset.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadRegistrationService.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadService.javacore/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceService.java
apps/api/src/main/java/**/*.java
⚙️ CodeRabbit configuration file
apps/api/src/main/java/**/*.java: Enforce the browser-BFF and resource-server boundaries. Authentication
must resolve an active internal actor through the explicit issuer and
subject binding. Reject identity, tenant, roles, or permissions supplied
by request payloads, JWT email, or untrusted JWT role claims.
Files:
apps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeSpaceResponse.javaapps/api/src/main/java/com/orgmemory/api/ApiExceptionHandler.javaapps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeSpaceController.javaapps/api/src/main/java/com/orgmemory/api/source/SourceController.java
docs/**/*.md
📄 CodeRabbit inference engine (docs/conventions.md)
docs/**/*.md: KeepARCHITECTURE.mdand specification documents limited to implemented facts; record intent in vision/roadmap documents, keep active increment plans separate, and explicitly supersede append-only decisions.
Do not create status-summary documents that duplicate existing sources of truth.
Files:
docs/increments/active/2026-07-22-secure-hybrid-retrieval/plan.mddocs/roadmap.mddocs/specs/domains/knowledge-ingestion.md
⚙️ CodeRabbit configuration file
docs/**/*.md: Preserve the thin-map documentation harness. Current facts belong in
architecture, specs, and tests only after implementation; future intent
belongs in vision, roadmap, or one active increment. Flag duplicated or
contradictory sources of truth.
Files:
docs/increments/active/2026-07-22-secure-hybrid-retrieval/plan.mddocs/roadmap.mddocs/specs/domains/knowledge-ingestion.md
docs/**/*
📄 CodeRabbit inference engine (docs/conventions.md)
Keep provider credentials out of clients, logs, documentation, and git.
Files:
docs/increments/active/2026-07-22-secure-hybrid-retrieval/plan.mddocs/roadmap.mddocs/specs/domains/knowledge-ingestion.md
docs/increments/active/**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
For each increment, create
docs/increments/active/YYYY-MM-DD-slug/design.mdfollowed byplan.md; execute one coherent slice, consolidate current facts/specs/tests/decisions, and move the increment tocompleted.
Files:
docs/increments/active/2026-07-22-secure-hybrid-retrieval/plan.md
**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
For frontend files, use Oxlint, TypeScript typecheck, the production build, and browser tests when the UI flow matters.
Files:
web/src/features/sources/api/upload-source.tsweb/src/features/session/csrf-fetch.tsweb/src/features/sources/components/source-upload-dialog.tsxweb/src/features/sources/components/sources-page.tsx
**/*.{ts,tsx,js,jsx,json,html,css,scss}
📄 CodeRabbit inference engine (CLAUDE.md)
Do not run JetBrains IDE inspection on TypeScript, TSX, or web configuration files.
Files:
web/src/features/sources/api/upload-source.tsweb/src/features/session/csrf-fetch.tsweb/src/features/sources/components/source-upload-dialog.tsxweb/src/features/sources/components/sources-page.tsx
web/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
web/src/**/*.{ts,tsx}: OAuth access and refresh tokens must never enter browser JavaScript or
browser storage. Use the HttpOnly BFF session, CSRF-protected mutations,
generated Hey API data clients, accessible states, and both light and
dark themes. Handwritten transport is reserved for documented protocol
flows such as navigation redirects and streaming.
Files:
web/src/features/sources/api/upload-source.tsweb/src/features/session/csrf-fetch.tsweb/src/features/sources/components/source-upload-dialog.tsxweb/src/features/sources/components/sources-page.tsx
core/src/main/resources/db/migration/*.sql
⚙️ CodeRabbit configuration file
core/src/main/resources/db/migration/*.sql: Flyway migrations are immutable after release. Check tenant isolation,
foreign keys, uniqueness, indexes, append-only evidence semantics, safe
defaults, and compatibility with PostgreSQL 18 plus pgvector.
Files:
core/src/main/resources/db/migration/V18__knowledge_space_upload_authorization.sql
**/*.{yml,yaml,properties}
📄 CodeRabbit inference engine (CLAUDE.md)
Keep
ddl-auto=validatein application configuration.
Files:
integrations/authorization-openfga/src/test/openfga/store.fga.yaml
integrations/authorization-openfga/**/*
⚙️ CodeRabbit configuration file
integrations/authorization-openfga/**/*: Source-native ACL is a hard ceiling. Flag any parent, organization, role,
or wildcard relation that can broaden source access. Require negative
Check and ListObjects coverage for every new permission path.
Files:
integrations/authorization-openfga/src/test/openfga/store.fga.yaml
🪛 PMD (7.26.0)
core/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceService.java
[Medium] 61-62: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'invalidProjection' on all code paths
(PreserveStackTrace (Best Practices))
🪛 SQLFluff (4.2.2)
core/src/main/resources/db/migration/V18__knowledge_space_upload_authorization.sql
[error] 163-164: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
[error] 165-166: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
[error] 167-168: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
🪛 Squawk (2.59.0)
core/src/main/resources/db/migration/V18__knowledge_space_upload_authorization.sql
[warning] 5-5: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 6-6: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 99-99: Setting a column NOT NULL blocks reads while the table is scanned. Make the field nullable and use a CHECK constraint instead.
(adding-not-nullable-field)
[warning] 100-102: By default new constraints require a table scan and block writes to the table while that scan occurs. Use NOT VALID with a later VALIDATE CONSTRAINT call.
(constraint-missing-not-valid)
[warning] 100-102: Adding a foreign key constraint requires a table scan and a SHARE ROW EXCLUSIVE lock on both tables, which blocks writes to each table. Add NOT VALID to the constraint in one transaction and then VALIDATE the constraint in a separate transaction.
(adding-foreign-key-constraint)
[warning] 114-114: Setting a column NOT NULL blocks reads while the table is scanned. Make the field nullable and use a CHECK constraint instead.
(adding-not-nullable-field)
[warning] 115-117: By default new constraints require a table scan and block writes to the table while that scan occurs. Use NOT VALID with a later VALIDATE CONSTRAINT call.
(constraint-missing-not-valid)
[warning] 115-117: Adding a foreign key constraint requires a table scan and a SHARE ROW EXCLUSIVE lock on both tables, which blocks writes to each table. Add NOT VALID to the constraint in one transaction and then VALIDATE the constraint in a separate transaction.
(adding-foreign-key-constraint)
[warning] 143-143: Setting a column NOT NULL blocks reads while the table is scanned. Make the field nullable and use a CHECK constraint instead.
(adding-not-nullable-field)
[warning] 144-146: By default new constraints require a table scan and block writes to the table while that scan occurs. Use NOT VALID with a later VALIDATE CONSTRAINT call.
(constraint-missing-not-valid)
[warning] 144-146: Adding a foreign key constraint requires a table scan and a SHARE ROW EXCLUSIVE lock on both tables, which blocks writes to each table. Add NOT VALID to the constraint in one transaction and then VALIDATE the constraint in a separate transaction.
(adding-foreign-key-constraint)
[warning] 158-158: Setting a column NOT NULL blocks reads while the table is scanned. Make the field nullable and use a CHECK constraint instead.
(adding-not-nullable-field)
[warning] 159-161: By default new constraints require a table scan and block writes to the table while that scan occurs. Use NOT VALID with a later VALIDATE CONSTRAINT call.
(constraint-missing-not-valid)
[warning] 159-161: Adding a foreign key constraint requires a table scan and a SHARE ROW EXCLUSIVE lock on both tables, which blocks writes to each table. Add NOT VALID to the constraint in one transaction and then VALIDATE the constraint in a separate transaction.
(adding-foreign-key-constraint)
[warning] 165-166: During normal index creation, table updates are blocked, but reads are still allowed. Use concurrently to avoid blocking writes.
(require-concurrent-index-creation)
[warning] 167-168: During normal index creation, table updates are blocked, but reads are still allowed. Use concurrently to avoid blocking writes.
(require-concurrent-index-creation)
🔇 Additional comments (38)
core/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationService.java (1)
43-46: LGTM!core/src/main/java/com/orgmemory/core/knowledge/KnowledgeIngestionService.java (1)
42-68: LGTM!Also applies to: 268-314
core/src/main/java/com/orgmemory/core/knowledge/SourceIngestionCoordinator.java (1)
137-137: LGTM!core/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationCoordinator.java (1)
33-36: LGTM!Also applies to: 132-132
apps/worker/src/main/java/com/orgmemory/worker/ingestion/SourceIngestionProcessor.java (1)
179-179: LGTM!Also applies to: 266-287
apps/worker/src/test/java/com/orgmemory/worker/ingestion/SourceIngestionPipelineIntegrationTests.java (1)
89-89: LGTM!Also applies to: 154-163, 373-382
apps/api/src/test/java/com/orgmemory/api/knowledge/KnowledgeIngestionIntegrationTests.java (1)
54-54: LGTM!Also applies to: 91-93, 196-199, 481-481
ARCHITECTURE.md (1)
62-62: LGTM!Also applies to: 78-83, 97-98, 107-116
docs/increments/active/2026-07-22-secure-hybrid-retrieval/plan.md (1)
40-42: LGTM!docs/roadmap.md (1)
13-14: LGTM!Also applies to: 29-30
docs/specs/domains/knowledge-ingestion.md (1)
6-18: LGTM!Also applies to: 31-40
core/src/main/java/com/orgmemory/core/knowledge/CreateUploadSourceCommand.java (1)
5-13: LGTM!core/src/main/java/com/orgmemory/core/knowledge/PromoteNormalizedRecordCommand.java (1)
6-10: LGTM!core/src/main/java/com/orgmemory/core/knowledge/PublishKnowledgeAssetCommand.java (1)
7-35: LGTM!core/src/main/java/com/orgmemory/core/knowledge/ClaimedSourceRevision.java (1)
8-27: LGTM!apps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeSpaceController.java (1)
24-31: LGTM!apps/api/src/main/java/com/orgmemory/api/ApiExceptionHandler.java (1)
58-61: LGTM!core/src/test/java/com/orgmemory/core/knowledge/KnowledgeSpaceServiceTests.java (1)
24-100: LGTM!core/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpace.java (1)
9-43: LGTM!core/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceRepository.java (1)
9-18: LGTM!core/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceTarget.java (2)
6-16: LGTM!
18-23: 🎯 Functional CorrectnessNo need to expose
requireTextKnowledgeSpaceTarget.requireText(...)is only used by the record itself;KnowledgeIngestionServicedefines a separate helper with the same name.> Likely an incorrect or invalid review comment.core/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceUnavailableException.java (1)
3-7: LGTM!core/src/main/java/com/orgmemory/core/knowledge/KnowledgeAsset.java (1)
24-25: LGTM!Also applies to: 76-80, 127-129
core/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationOutbox.java (1)
20-21: LGTM!Also applies to: 74-102, 135-136
core/src/main/java/com/orgmemory/core/knowledge/KnowledgeAssetPublicationState.java (1)
5-17: LGTM!core/src/main/java/com/orgmemory/core/knowledge/SourceObject.java (1)
20-21: LGTM!Also applies to: 60-81, 91-92
core/src/main/java/com/orgmemory/core/knowledge/SourceRevision.java (1)
21-22: LGTM!Also applies to: 99-119, 172-173
core/src/main/java/com/orgmemory/core/knowledge/KnowledgeSpaceService.java (1)
19-110: LGTM!apps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeSpaceResponse.java (1)
6-15: LGTM!apps/api/src/main/java/com/orgmemory/api/source/SourceController.java (1)
12-12: LGTM!Also applies to: 53-64
core/src/main/java/com/orgmemory/core/knowledge/SourceUploadService.java (1)
29-59: LGTM!Also applies to: 83-83, 118-121
core/src/main/java/com/orgmemory/core/knowledge/SourceUploadRegistrationService.java (1)
40-49: LGTM!core/src/test/java/com/orgmemory/core/knowledge/SourceUploadServiceTests.java (1)
20-51: LGTM!web/src/features/session/csrf-fetch.ts (1)
29-36: LGTM!web/src/features/sources/api/upload-source.ts (1)
6-15: LGTM!web/src/features/sources/components/source-upload-dialog.tsx (1)
19-68: LGTM!Also applies to: 104-151, 173-176
web/src/features/sources/components/sources-page.tsx (1)
20-24: LGTM!Also applies to: 37-37, 77-80
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
web/src/features/sources/components/source-upload-dialog.tsx (1)
43-45: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winClear or reject a space that becomes ineligible.
A no-department space selected under
INTERNALremains selected after switching toPUBLICorRESTRICTED, even thoughavailableSpacesremoves it. If another eligible space exists, submit remains enabled and sends the now-hidden ID.Proposed fix
onValueChange={(value: string) => { const next = value as UploadSourceInput["classification"] setClassification(next) const selected = spaces.find((space) => space.id === knowledgeSpaceId) - if (next === "CONFIDENTIAL" && !selected?.departmentId) setKnowledgeSpaceId("") + const stillEligible = + selected?.id && + selected.name && + (next === "INTERNAL" || Boolean(selected.departmentId)) + if (!stillEligible) setKnowledgeSpaceId("") }}Also applies to: 54-64, 146-151
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@web/src/features/sources/components/source-upload-dialog.tsx` around lines 43 - 45, Update the source selection state alongside the availableSpaces filtering so a selected space that becomes ineligible after classification changes is cleared or rejected. Ensure the submit flow uses only currently eligible spaces, including the related selection initialization and submit logic around the source upload dialog.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@integrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.java`:
- Around line 75-80: Capture the ClientBatchCheckRequest passed to
client.batchCheck in the test, then assert its outgoing checks use correlation
IDs "0" and "1" before validating the mocked response. Keep the existing
allowedItem and deniedItem response assertions unchanged.
---
Outside diff comments:
In `@web/src/features/sources/components/source-upload-dialog.tsx`:
- Around line 43-45: Update the source selection state alongside the
availableSpaces filtering so a selected space that becomes ineligible after
classification changes is cleared or rejected. Ensure the submit flow uses only
currently eligible spaces, including the related selection initialization and
submit logic around the source upload dialog.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: b5453427-2c43-436d-bc10-e65d99502432
⛔ Files ignored due to path filters (1)
demo/fixtures/openfga/dataset-tuples.csvis excluded by!**/*.csv
📒 Files selected for processing (20)
.env.exampleapps/api/src/main/java/com/orgmemory/api/source/SourceController.javaapps/api/src/main/resources/application.ymlapps/worker/src/main/java/com/orgmemory/worker/OrgMemoryWorkerApplication.javaapps/worker/src/main/java/com/orgmemory/worker/ingestion/SourceIngestionProcessor.javaapps/worker/src/main/resources/application.ymlcore/src/main/java/com/orgmemory/core/knowledge/SecureKnowledgeRetrievalStore.javacore/src/main/java/com/orgmemory/core/knowledge/SourceObjectRepository.javacore/src/main/java/com/orgmemory/core/knowledge/SourceQueryService.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadService.javacore/src/test/java/com/orgmemory/core/knowledge/SourceQueryServiceTests.javademo/fixtures/postgres/directory.sqldocs/specs/domains/knowledge-ingestion.mdintegrations/ai-openai-compatible/src/main/java/com/orgmemory/integrations/ai/openai/AiGatewayProperties.javaintegrations/ai-openai-compatible/src/test/java/com/orgmemory/integrations/ai/openai/AiGatewayPropertiesTests.javaintegrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationAdapter.javaintegrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapter.javaintegrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.javaweb/src/features/sources/api/upload-source.tsweb/src/features/sources/components/source-upload-dialog.tsx
💤 Files with no reviewable changes (1)
- core/src/main/java/com/orgmemory/core/knowledge/SourceUploadService.java
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Backend · Java 25
🧰 Additional context used
📓 Path-based instructions (12)
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
**/*: Before changing unfamiliar Spring Boot 4, Spring Modulith 2, Spring AI 2, Gradle, React, Vite, Tailwind, or TypeScript APIs, consult Context7/current official documentation and the projectorgmemory-*verification skills.
Readdocs/guidelines/agent-safety.mdbefore retrieval, AI, MCP, permission, upload, graph, or export work.
Never commit.envfiles, provider keys, tokens, or customer data.
Run the relevant gates fromdocs/guidelines/testing-harness.md; use a terminating clean test as the context gate, and do not treatbootRunas verification.
Current behavior belongs in architecture/specs only after it exists in code; intent belongs in vision, roadmap, or an active increment, and repository state must not be duplicated across documents.
Files:
apps/worker/src/main/resources/application.ymlcore/src/main/java/com/orgmemory/core/knowledge/SourceObjectRepository.javacore/src/main/java/com/orgmemory/core/knowledge/SecureKnowledgeRetrievalStore.javademo/fixtures/postgres/directory.sqlapps/worker/src/main/java/com/orgmemory/worker/OrgMemoryWorkerApplication.javaapps/api/src/main/java/com/orgmemory/api/source/SourceController.javaweb/src/features/sources/api/upload-source.tsintegrations/ai-openai-compatible/src/main/java/com/orgmemory/integrations/ai/openai/AiGatewayProperties.javaintegrations/ai-openai-compatible/src/test/java/com/orgmemory/integrations/ai/openai/AiGatewayPropertiesTests.javaintegrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationAdapter.javadocs/specs/domains/knowledge-ingestion.mdcore/src/test/java/com/orgmemory/core/knowledge/SourceQueryServiceTests.javaintegrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.javaintegrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapter.javaapps/worker/src/main/java/com/orgmemory/worker/ingestion/SourceIngestionProcessor.javaweb/src/features/sources/components/source-upload-dialog.tsxapps/api/src/main/resources/application.ymlcore/src/main/java/com/orgmemory/core/knowledge/SourceQueryService.java
**/*.{yml,yaml,properties}
📄 CodeRabbit inference engine (CLAUDE.md)
Keep
ddl-auto=validatein application configuration.
Files:
apps/worker/src/main/resources/application.ymlapps/api/src/main/resources/application.yml
**/*.{java,sql}
📄 CodeRabbit inference engine (CLAUDE.md)
Pair JPA schema changes with a Flyway migration.
Files:
core/src/main/java/com/orgmemory/core/knowledge/SourceObjectRepository.javacore/src/main/java/com/orgmemory/core/knowledge/SecureKnowledgeRetrievalStore.javademo/fixtures/postgres/directory.sqlapps/worker/src/main/java/com/orgmemory/worker/OrgMemoryWorkerApplication.javaapps/api/src/main/java/com/orgmemory/api/source/SourceController.javaintegrations/ai-openai-compatible/src/main/java/com/orgmemory/integrations/ai/openai/AiGatewayProperties.javaintegrations/ai-openai-compatible/src/test/java/com/orgmemory/integrations/ai/openai/AiGatewayPropertiesTests.javaintegrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationAdapter.javacore/src/test/java/com/orgmemory/core/knowledge/SourceQueryServiceTests.javaintegrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.javaintegrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapter.javaapps/worker/src/main/java/com/orgmemory/worker/ingestion/SourceIngestionProcessor.javacore/src/main/java/com/orgmemory/core/knowledge/SourceQueryService.java
**/*.java
📄 CodeRabbit inference engine (CLAUDE.md)
JetBrains IDE inspection is a Java-backend gate only.
Files:
core/src/main/java/com/orgmemory/core/knowledge/SourceObjectRepository.javacore/src/main/java/com/orgmemory/core/knowledge/SecureKnowledgeRetrievalStore.javaapps/worker/src/main/java/com/orgmemory/worker/OrgMemoryWorkerApplication.javaapps/api/src/main/java/com/orgmemory/api/source/SourceController.javaintegrations/ai-openai-compatible/src/main/java/com/orgmemory/integrations/ai/openai/AiGatewayProperties.javaintegrations/ai-openai-compatible/src/test/java/com/orgmemory/integrations/ai/openai/AiGatewayPropertiesTests.javaintegrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationAdapter.javacore/src/test/java/com/orgmemory/core/knowledge/SourceQueryServiceTests.javaintegrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.javaintegrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapter.javaapps/worker/src/main/java/com/orgmemory/worker/ingestion/SourceIngestionProcessor.javacore/src/main/java/com/orgmemory/core/knowledge/SourceQueryService.java
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java
⚙️ CodeRabbit configuration file
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java: Treat PostgreSQL ACL evidence as canonical and OpenFGA as the relationship
authorization decision point. Authorization must fail closed. Filtering
must happen before ranking, LIMIT, graph traversal, answer generation,
export, and citation rendering. Flag metadata or timing leak paths.
Files:
core/src/main/java/com/orgmemory/core/knowledge/SourceObjectRepository.javacore/src/main/java/com/orgmemory/core/knowledge/SecureKnowledgeRetrievalStore.javacore/src/main/java/com/orgmemory/core/knowledge/SourceQueryService.java
apps/api/src/main/java/**/*.java
⚙️ CodeRabbit configuration file
apps/api/src/main/java/**/*.java: Enforce the browser-BFF and resource-server boundaries. Authentication
must resolve an active internal actor through the explicit issuer and
subject binding. Reject identity, tenant, roles, or permissions supplied
by request payloads, JWT email, or untrusted JWT role claims.
Files:
apps/api/src/main/java/com/orgmemory/api/source/SourceController.java
**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
For frontend files, use Oxlint, TypeScript typecheck, the production build, and browser tests when the UI flow matters.
Files:
web/src/features/sources/api/upload-source.tsweb/src/features/sources/components/source-upload-dialog.tsx
**/*.{ts,tsx,js,jsx,json,html,css,scss}
📄 CodeRabbit inference engine (CLAUDE.md)
Do not run JetBrains IDE inspection on TypeScript, TSX, or web configuration files.
Files:
web/src/features/sources/api/upload-source.tsweb/src/features/sources/components/source-upload-dialog.tsx
web/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
web/src/**/*.{ts,tsx}: OAuth access and refresh tokens must never enter browser JavaScript or
browser storage. Use the HttpOnly BFF session, CSRF-protected mutations,
generated Hey API data clients, accessible states, and both light and
dark themes. Handwritten transport is reserved for documented protocol
flows such as navigation redirects and streaming.
Files:
web/src/features/sources/api/upload-source.tsweb/src/features/sources/components/source-upload-dialog.tsx
integrations/authorization-openfga/**/*
⚙️ CodeRabbit configuration file
integrations/authorization-openfga/**/*: Source-native ACL is a hard ceiling. Flag any parent, organization, role,
or wildcard relation that can broaden source access. Require negative
Check and ListObjects coverage for every new permission path.
Files:
integrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationAdapter.javaintegrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.javaintegrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapter.java
docs/**/*.md
📄 CodeRabbit inference engine (docs/conventions.md)
docs/**/*.md: KeepARCHITECTURE.mdand specification documents limited to implemented facts; record intent in vision/roadmap documents, keep active increment plans separate, and explicitly supersede append-only decisions.
Do not create status-summary documents that duplicate existing sources of truth.
Files:
docs/specs/domains/knowledge-ingestion.md
⚙️ CodeRabbit configuration file
docs/**/*.md: Preserve the thin-map documentation harness. Current facts belong in
architecture, specs, and tests only after implementation; future intent
belongs in vision, roadmap, or one active increment. Flag duplicated or
contradictory sources of truth.
Files:
docs/specs/domains/knowledge-ingestion.md
docs/**/*
📄 CodeRabbit inference engine (docs/conventions.md)
Keep provider credentials out of clients, logs, documentation, and git.
Files:
docs/specs/domains/knowledge-ingestion.md
🪛 PMD (7.26.0)
integrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationAdapter.java
[Low] 59-64: InvalidLogMessageFormat (Error Prone): Too many arguments, expected 3 arguments but found 4
(InvalidLogMessageFormat (Error Prone))
integrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapter.java
[Low] 64-69: InvalidLogMessageFormat (Error Prone): Too many arguments, expected 3 arguments but found 4
(InvalidLogMessageFormat (Error Prone))
[Low] 116-120: InvalidLogMessageFormat (Error Prone): Too many arguments, expected 2 arguments but found 3
(InvalidLogMessageFormat (Error Prone))
core/src/main/java/com/orgmemory/core/knowledge/SourceQueryService.java
[Medium] 96-97: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'invalidResource' on all code paths
(PreserveStackTrace (Best Practices))
🔇 Additional comments (20)
integrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationAdapter.java (1)
15-21: LGTM!Also applies to: 59-64
integrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapter.java (1)
17-31: LGTM!Also applies to: 64-91, 116-120
integrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.java (1)
95-95: LGTM!Also applies to: 149-154
apps/api/src/main/java/com/orgmemory/api/source/SourceController.java (1)
41-44: LGTM!Also applies to: 53-64
web/src/features/sources/api/upload-source.ts (1)
3-7: LGTM!web/src/features/sources/components/source-upload-dialog.tsx (1)
104-139: LGTM!Also applies to: 157-160, 175-178
apps/worker/src/main/java/com/orgmemory/worker/ingestion/SourceIngestionProcessor.java (1)
177-187: LGTM!Also applies to: 248-285
core/src/main/java/com/orgmemory/core/knowledge/SecureKnowledgeRetrievalStore.java (1)
220-230: LGTM!core/src/main/java/com/orgmemory/core/knowledge/SourceObjectRepository.java (1)
3-3: LGTM!Also applies to: 13-14
core/src/main/java/com/orgmemory/core/knowledge/SourceQueryService.java (1)
23-140: LGTM!core/src/test/java/com/orgmemory/core/knowledge/SourceQueryServiceTests.java (1)
52-107: LGTM!apps/worker/src/main/java/com/orgmemory/worker/OrgMemoryWorkerApplication.java (1)
3-3: LGTM!Also applies to: 20-24
docs/specs/domains/knowledge-ingestion.md (1)
5-22: LGTM!Also applies to: 31-41
demo/fixtures/postgres/directory.sql (1)
10-17: LGTM!integrations/ai-openai-compatible/src/main/java/com/orgmemory/integrations/ai/openai/AiGatewayProperties.java (1)
90-98: LGTM!integrations/ai-openai-compatible/src/test/java/com/orgmemory/integrations/ai/openai/AiGatewayPropertiesTests.java (1)
47-53: LGTM!.env.example (1)
5-6: LGTM!apps/api/src/main/resources/application.yml (2)
11-11: LGTM!Also applies to: 59-65
58-58: 🎯 Functional CorrectnessNo change needed for the OpenAI base URL
The
/v1default belongs toorgmemory.ai.gateways.openai.base-urlin both files; there is nospring.ai.openai.base-urlhere, so this change is not needed.> Likely an incorrect or invalid review comment.apps/worker/src/main/resources/application.yml (1)
6-6: LGTM!Also applies to: 37-43
| ClientBatchCheckItem allowedItem = item(allowed, "0"); | ||
| ClientBatchCheckItem deniedItem = item(denied, "1"); | ||
| when(client.batchCheck(any(ClientBatchCheckRequest.class))).thenReturn( | ||
| CompletableFuture.completedFuture(new ClientBatchCheckResponse(List.of( | ||
| new ClientBatchCheckSingleResponse(true, allowedItem, allowed.openFgaObject(), null), | ||
| new ClientBatchCheckSingleResponse(false, deniedItem, denied.openFgaObject(), null))))); | ||
| new ClientBatchCheckSingleResponse(true, allowedItem, "0", null), | ||
| new ClientBatchCheckSingleResponse(false, deniedItem, "1", null))))); |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
Assert the outgoing correlation IDs as well.
Because client.batchCheck(any(...)) ignores the request, this test would still pass if the adapter sent incorrect correlation IDs. Capture the ClientBatchCheckRequest and assert that its checks use "0" and "1" before validating the mocked response.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@integrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.java`
around lines 75 - 80, Capture the ClientBatchCheckRequest passed to
client.batchCheck in the test, then assert its outgoing checks use correlation
IDs "0" and "1" before validating the mocked response. Keep the existing
allowedItem and deniedItem response assertions unchanged.
1 participant
What changed
ListObjects(can_create_asset)and recheck permission before storageknowledge_space_idthrough source, revision, ingestion, asset, and publication recordsWhy
Uploads previously had no explicit destination boundary. This makes knowledge placement permission-aware at creation time while retaining source ACL and classification checks for retrieval.
Validation
fga model validatefga model test— 6/6 tests, 29/29 checks, 5/5 ListObjects assertions./gradlew --no-daemon clean testcorepack pnpm -C web check:apicorepack pnpm -C web build201 CreatedSummary by CodeRabbit