Harden production security and Capability Asset listing - #12
Conversation
|
Warning Review limit reached
Next review available in: 20 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThe PR batches capability-asset authorization and usage retrieval, adds production configuration validation, restricts Swagger to development, changes OIDC logout redirects to ChangesBatched Capability-Asset Retrieval
Production and Browser Security Hardening
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant CapabilityAssetController
participant CapabilityAssetService
participant OpenFGA
participant Database
Client->>CapabilityAssetController: GET /api/assets
CapabilityAssetController->>CapabilityAssetService: searchListings(...)
CapabilityAssetService->>OpenFGA: ListObjects and contextual BatchCheck
OpenFGA-->>CapabilityAssetService: authorized assets
CapabilityAssetService->>Database: aggregate usage query
Database-->>CapabilityAssetService: usage totals
CapabilityAssetService-->>CapabilityAssetController: asset listings
CapabilityAssetController-->>Client: capability asset responses
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@apps/api/src/test/java/com/orgmemory/api/capability/CapabilityAssetServiceIntegrationTests.java`:
- Around line 172-184: The test method
listUsesSetAuthorizationInsteadOfPerAssetChecks must assert that usage retrieval
performs one aggregate query rather than per-asset count queries, using the
relevant usage repository or query mock. In
docs/tests/domains/capability-assets.md at line 10, correct the reference to
batchCheckSendsResourceSpecificContextualRelationships; retain the aggregate
usage coverage claim only after the test assertion is added.
In
`@core/src/main/java/com/orgmemory/core/authorization/BatchAuthorizationQuery.java`:
- Around line 4-8: Add the missing java.util.HashSet import to
BatchAuthorizationQuery, matching the existing HashSet usage near line 33 so the
file compiles.
In
`@integrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.java`:
- Around line 102-129: Expand
batchCheckSendsResourceSpecificContextualRelationships to use two distinct
resources, each with a different contextual relationship, and include both in
the query’s resource list and contextual relationship map. Capture the emitted
checks and assert each resource’s ClientBatchCheckItem contains exactly one
tuple belonging only to that resource, including its expected user, relation,
and object.
In `@web/src/features/session/login-page.tsx`:
- Line 15: Update the logout flow around the search.loggedOut handling so
successful logout still produces the concise status feedback required by
docs/tests/browser-authentication.md despite the exact /login redirect. Prefer
adding a server-side or session-backed notice that the login page can render;
alternatively, update the documented verification contract and its associated
tests to explicitly accept no logout message.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: eae7dd11-fd5c-485f-946e-c47a78c978fd
📒 Files selected for processing (31)
ARCHITECTURE.mdREADME.mdapps/api/src/main/java/com/orgmemory/api/capability/CapabilityAssetController.javaapps/api/src/main/java/com/orgmemory/api/security/ProductionConfigurationGuard.javaapps/api/src/main/java/com/orgmemory/api/security/ProductionSecurityConfiguration.javaapps/api/src/main/java/com/orgmemory/api/security/SecurityConfig.javaapps/api/src/main/resources/application-dev.ymlapps/api/src/main/resources/application-prod.ymlapps/api/src/main/resources/application.ymlapps/api/src/test/java/com/orgmemory/api/capability/CapabilityAssetServiceIntegrationTests.javaapps/api/src/test/java/com/orgmemory/api/security/OidcLogoutConfigurationTests.javaapps/api/src/test/java/com/orgmemory/api/security/ProductionConfigurationGuardTests.javaapps/api/src/test/java/com/orgmemory/api/security/SwaggerProfileConfigurationTests.javaapps/worker/src/main/resources/application-prod.ymlcore/src/main/java/com/orgmemory/core/authorization/BatchAuthorizationQuery.javacore/src/main/java/com/orgmemory/core/capability/AssetUsageEventRepository.javacore/src/main/java/com/orgmemory/core/capability/AssetUsageTotal.javacore/src/main/java/com/orgmemory/core/capability/CapabilityAssetListing.javacore/src/main/java/com/orgmemory/core/capability/CapabilityAssetService.javacore/src/test/java/com/orgmemory/core/authorization/BatchAuthorizationQueryTests.javadocs/increments/completed/2026-07-22-production-hardening/design.mddocs/increments/completed/2026-07-22-production-hardening/plan.mddocs/roadmap.mddocs/specs/domains/capability-assets.mddocs/specs/domains/identity-and-organization.mddocs/tests/browser-authentication.mddocs/tests/domains/capability-assets.mdintegrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapter.javaintegrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.javaweb/src/features/session/login-page.tsxweb/src/routes/login.tsx
💤 Files with no reviewable changes (1)
- web/src/routes/login.tsx
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Backend · Java 25
🧰 Additional context used
📓 Path-based instructions (12)
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
**/*: Before changing unfamiliar Spring Boot 4, Spring Modulith 2, Spring AI 2, Gradle, React, Vite, Tailwind, or TypeScript APIs, consult Context7/current official documentation and the projectorgmemory-*verification skills.
Readdocs/guidelines/agent-safety.mdbefore retrieval, AI, MCP, permission, upload, graph, or export work.
Never commit.envfiles, provider keys, tokens, or customer data.
Run the relevant gates fromdocs/guidelines/testing-harness.md; use a terminating clean test as the context gate, and do not treatbootRunas verification.
Current behavior belongs in architecture/specs only after it exists in code; intent belongs in vision, roadmap, or an active increment, and repository state must not be duplicated across documents.
Files:
apps/api/src/main/resources/application-dev.ymlcore/src/main/java/com/orgmemory/core/capability/CapabilityAssetListing.javaapps/worker/src/main/resources/application-prod.ymlcore/src/main/java/com/orgmemory/core/capability/AssetUsageEventRepository.javaweb/src/features/session/login-page.tsxdocs/tests/domains/capability-assets.mdapps/api/src/test/java/com/orgmemory/api/security/OidcLogoutConfigurationTests.javaapps/api/src/main/resources/application.ymlapps/api/src/test/java/com/orgmemory/api/security/SwaggerProfileConfigurationTests.javacore/src/main/java/com/orgmemory/core/capability/AssetUsageTotal.javadocs/specs/domains/capability-assets.mdcore/src/test/java/com/orgmemory/core/authorization/BatchAuthorizationQueryTests.javadocs/increments/completed/2026-07-22-production-hardening/plan.mdapps/api/src/main/java/com/orgmemory/api/security/ProductionSecurityConfiguration.javadocs/increments/completed/2026-07-22-production-hardening/design.mddocs/specs/domains/identity-and-organization.mdapps/api/src/main/resources/application-prod.ymlapps/api/src/main/java/com/orgmemory/api/security/ProductionConfigurationGuard.javaapps/api/src/main/java/com/orgmemory/api/capability/CapabilityAssetController.javadocs/roadmap.mddocs/tests/browser-authentication.mdARCHITECTURE.mdintegrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapter.javaapps/api/src/test/java/com/orgmemory/api/security/ProductionConfigurationGuardTests.javacore/src/main/java/com/orgmemory/core/authorization/BatchAuthorizationQuery.javaintegrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.javaapps/api/src/test/java/com/orgmemory/api/capability/CapabilityAssetServiceIntegrationTests.javaapps/api/src/main/java/com/orgmemory/api/security/SecurityConfig.javacore/src/main/java/com/orgmemory/core/capability/CapabilityAssetService.javaREADME.md
**/*.{yml,yaml,properties}
📄 CodeRabbit inference engine (CLAUDE.md)
Keep
ddl-auto=validatein application configuration.
Files:
apps/api/src/main/resources/application-dev.ymlapps/worker/src/main/resources/application-prod.ymlapps/api/src/main/resources/application.ymlapps/api/src/main/resources/application-prod.yml
**/*.{java,sql}
📄 CodeRabbit inference engine (CLAUDE.md)
Pair JPA schema changes with a Flyway migration.
Files:
core/src/main/java/com/orgmemory/core/capability/CapabilityAssetListing.javacore/src/main/java/com/orgmemory/core/capability/AssetUsageEventRepository.javaapps/api/src/test/java/com/orgmemory/api/security/OidcLogoutConfigurationTests.javaapps/api/src/test/java/com/orgmemory/api/security/SwaggerProfileConfigurationTests.javacore/src/main/java/com/orgmemory/core/capability/AssetUsageTotal.javacore/src/test/java/com/orgmemory/core/authorization/BatchAuthorizationQueryTests.javaapps/api/src/main/java/com/orgmemory/api/security/ProductionSecurityConfiguration.javaapps/api/src/main/java/com/orgmemory/api/security/ProductionConfigurationGuard.javaapps/api/src/main/java/com/orgmemory/api/capability/CapabilityAssetController.javaintegrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapter.javaapps/api/src/test/java/com/orgmemory/api/security/ProductionConfigurationGuardTests.javacore/src/main/java/com/orgmemory/core/authorization/BatchAuthorizationQuery.javaintegrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.javaapps/api/src/test/java/com/orgmemory/api/capability/CapabilityAssetServiceIntegrationTests.javaapps/api/src/main/java/com/orgmemory/api/security/SecurityConfig.javacore/src/main/java/com/orgmemory/core/capability/CapabilityAssetService.java
**/*.java
📄 CodeRabbit inference engine (CLAUDE.md)
JetBrains IDE inspection is a Java-backend gate only.
Files:
core/src/main/java/com/orgmemory/core/capability/CapabilityAssetListing.javacore/src/main/java/com/orgmemory/core/capability/AssetUsageEventRepository.javaapps/api/src/test/java/com/orgmemory/api/security/OidcLogoutConfigurationTests.javaapps/api/src/test/java/com/orgmemory/api/security/SwaggerProfileConfigurationTests.javacore/src/main/java/com/orgmemory/core/capability/AssetUsageTotal.javacore/src/test/java/com/orgmemory/core/authorization/BatchAuthorizationQueryTests.javaapps/api/src/main/java/com/orgmemory/api/security/ProductionSecurityConfiguration.javaapps/api/src/main/java/com/orgmemory/api/security/ProductionConfigurationGuard.javaapps/api/src/main/java/com/orgmemory/api/capability/CapabilityAssetController.javaintegrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapter.javaapps/api/src/test/java/com/orgmemory/api/security/ProductionConfigurationGuardTests.javacore/src/main/java/com/orgmemory/core/authorization/BatchAuthorizationQuery.javaintegrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.javaapps/api/src/test/java/com/orgmemory/api/capability/CapabilityAssetServiceIntegrationTests.javaapps/api/src/main/java/com/orgmemory/api/security/SecurityConfig.javacore/src/main/java/com/orgmemory/core/capability/CapabilityAssetService.java
**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
For frontend files, use Oxlint, TypeScript typecheck, the production build, and browser tests when the UI flow matters.
Files:
web/src/features/session/login-page.tsx
**/*.{ts,tsx,js,jsx,json,html,css,scss}
📄 CodeRabbit inference engine (CLAUDE.md)
Do not run JetBrains IDE inspection on TypeScript, TSX, or web configuration files.
Files:
web/src/features/session/login-page.tsx
web/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
web/src/**/*.{ts,tsx}: OAuth access and refresh tokens must never enter browser JavaScript or
browser storage. Use the HttpOnly BFF session, CSRF-protected mutations,
generated Hey API data clients, accessible states, and both light and
dark themes. Handwritten transport is reserved for documented protocol
flows such as navigation redirects and streaming.
Files:
web/src/features/session/login-page.tsx
docs/**/*.md
📄 CodeRabbit inference engine (docs/conventions.md)
docs/**/*.md: KeepARCHITECTURE.mdand specification documents limited to implemented facts; record intent in vision/roadmap documents, keep active increment plans separate, and explicitly supersede append-only decisions.
Do not create status-summary documents that duplicate existing sources of truth.
Files:
docs/tests/domains/capability-assets.mddocs/specs/domains/capability-assets.mddocs/increments/completed/2026-07-22-production-hardening/plan.mddocs/increments/completed/2026-07-22-production-hardening/design.mddocs/specs/domains/identity-and-organization.mddocs/roadmap.mddocs/tests/browser-authentication.md
⚙️ CodeRabbit configuration file
docs/**/*.md: Preserve the thin-map documentation harness. Current facts belong in
architecture, specs, and tests only after implementation; future intent
belongs in vision, roadmap, or one active increment. Flag duplicated or
contradictory sources of truth.
Files:
docs/tests/domains/capability-assets.mddocs/specs/domains/capability-assets.mddocs/increments/completed/2026-07-22-production-hardening/plan.mddocs/increments/completed/2026-07-22-production-hardening/design.mddocs/specs/domains/identity-and-organization.mddocs/roadmap.mddocs/tests/browser-authentication.md
docs/**/*
📄 CodeRabbit inference engine (docs/conventions.md)
Keep provider credentials out of clients, logs, documentation, and git.
Files:
docs/tests/domains/capability-assets.mddocs/specs/domains/capability-assets.mddocs/increments/completed/2026-07-22-production-hardening/plan.mddocs/increments/completed/2026-07-22-production-hardening/design.mddocs/specs/domains/identity-and-organization.mddocs/roadmap.mddocs/tests/browser-authentication.md
apps/api/src/main/java/**/*.java
⚙️ CodeRabbit configuration file
apps/api/src/main/java/**/*.java: Enforce the browser-BFF and resource-server boundaries. Authentication
must resolve an active internal actor through the explicit issuer and
subject binding. Reject identity, tenant, roles, or permissions supplied
by request payloads, JWT email, or untrusted JWT role claims.
Files:
apps/api/src/main/java/com/orgmemory/api/security/ProductionSecurityConfiguration.javaapps/api/src/main/java/com/orgmemory/api/security/ProductionConfigurationGuard.javaapps/api/src/main/java/com/orgmemory/api/capability/CapabilityAssetController.javaapps/api/src/main/java/com/orgmemory/api/security/SecurityConfig.java
integrations/authorization-openfga/**/*
⚙️ CodeRabbit configuration file
integrations/authorization-openfga/**/*: Source-native ACL is a hard ceiling. Flag any parent, organization, role,
or wildcard relation that can broaden source access. Require negative
Check and ListObjects coverage for every new permission path.
Files:
integrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapter.javaintegrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.java
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java
⚙️ CodeRabbit configuration file
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java: Treat PostgreSQL ACL evidence as canonical and OpenFGA as the relationship
authorization decision point. Authorization must fail closed. Filtering
must happen before ranking, LIMIT, graph traversal, answer generation,
export, and citation rendering. Flag metadata or timing leak paths.
Files:
core/src/main/java/com/orgmemory/core/authorization/BatchAuthorizationQuery.java
🔇 Additional comments (28)
apps/api/src/main/java/com/orgmemory/api/security/ProductionSecurityConfiguration.java (1)
12-37: LGTM!apps/api/src/main/java/com/orgmemory/api/security/ProductionConfigurationGuard.java (1)
12-108: LGTM!apps/api/src/main/resources/application-prod.yml (1)
1-54: LGTM!apps/worker/src/main/resources/application-prod.yml (1)
1-31: LGTM!apps/api/src/main/resources/application.yml (1)
50-54: LGTM!apps/api/src/test/java/com/orgmemory/api/security/ProductionConfigurationGuardTests.java (1)
20-132: LGTM!README.md (1)
36-36: LGTM!Also applies to: 46-59
docs/increments/completed/2026-07-22-production-hardening/plan.md (1)
1-13: LGTM!apps/api/src/main/java/com/orgmemory/api/security/SecurityConfig.java (2)
71-79: 🔒 Security & PrivacyMake Swagger exposure exclusive to development deployments.
acceptsProfiles(Profiles.of("dev"))permits thepermitAllbranch wheneverdevmatches. Adev,proddeployment—or one withdevas its default profile—would therefore still expose Swagger, so this code alone does not enforce the “dev-only” contract. Reject mixed/default production profiles inProductionConfigurationGuard, or gate on an explicitly active development profile and add a profile-matrix test. Spring also evaluates default profiles when no explicit profile is active. (docs.spring.io)
10-11: LGTM!Also applies to: 29-29, 60-70, 80-92, 105-114
apps/api/src/main/resources/application-dev.yml (1)
1-5: LGTM!apps/api/src/test/java/com/orgmemory/api/security/SwaggerProfileConfigurationTests.java (1)
1-29: LGTM!apps/api/src/test/java/com/orgmemory/api/security/OidcLogoutConfigurationTests.java (1)
1-49: LGTM!docs/specs/domains/identity-and-organization.md (1)
14-15: LGTM!Also applies to: 28-31
docs/tests/browser-authentication.md (1)
22-27: LGTM!core/src/main/java/com/orgmemory/core/capability/AssetUsageTotal.java (1)
1-10: LGTM!core/src/main/java/com/orgmemory/core/capability/CapabilityAssetListing.java (1)
1-13: LGTM!core/src/main/java/com/orgmemory/core/capability/AssetUsageEventRepository.java (1)
3-20: LGTM!docs/increments/completed/2026-07-22-production-hardening/design.md (1)
1-21: LGTM!core/src/main/java/com/orgmemory/core/capability/CapabilityAssetService.java (1)
3-57: LGTM!Also applies to: 88-117, 260-311
apps/api/src/main/java/com/orgmemory/api/capability/CapabilityAssetController.java (1)
43-44: LGTM!docs/roadmap.md (1)
17-18: LGTM!Also applies to: 30-31
integrations/authorization-openfga/src/main/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapter.java (1)
14-14: LGTM!Also applies to: 88-93
core/src/test/java/com/orgmemory/core/authorization/BatchAuthorizationQueryTests.java (1)
1-37: LGTM!integrations/authorization-openfga/src/test/java/com/orgmemory/integrations/authorization/openfga/OpenFgaRelationshipAuthorizationSetAdapterTests.java (1)
8-13: LGTM!Also applies to: 29-29
apps/api/src/test/java/com/orgmemory/api/capability/CapabilityAssetServiceIntegrationTests.java (1)
8-13: LGTM!Also applies to: 34-38, 106-136, 186-203
ARCHITECTURE.md (1)
106-109: LGTM!Also applies to: 149-154, 178-178
docs/specs/domains/capability-assets.md (1)
32-36: LGTM!
| import java.util.LinkedHashMap; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
| import java.util.Objects; | ||
| import java.util.UUID; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Import HashSet.
HashSet is used on Line 33 but is not imported, so this file does not compile.
Proposed fix
+import java.util.HashSet;
import java.util.LinkedHashMap;📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| import java.util.LinkedHashMap; | |
| import java.util.List; | |
| import java.util.Map; | |
| import java.util.Objects; | |
| import java.util.UUID; | |
| import java.util.HashSet; | |
| import java.util.LinkedHashMap; | |
| import java.util.List; | |
| import java.util.Map; | |
| import java.util.Objects; | |
| import java.util.UUID; |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@core/src/main/java/com/orgmemory/core/authorization/BatchAuthorizationQuery.java`
around lines 4 - 8, Add the missing java.util.HashSet import to
BatchAuthorizationQuery, matching the existing HashSet usage near line 33 so the
file compiles.
1 participant
What changed
/loginpost-logout redirect.ListObjectsplus one contextual
BatchCheck.devprofile.
prodprofiles and API startup validation forrequired secrets and security-critical configuration.
increment.
Why
The previous logout URL encoded a query marker into the Keycloak post-logout
redirect and produced HTTP 400. Capability Asset listing performed repeated
authorization and usage-count calls per asset. Swagger was publicly permitted
regardless of runtime profile, and production could inherit local configuration
defaults.
Impact
/login.OpenFGA results.
stop API startup.
Validation
.\gradlew.bat --no-daemon clean test.\gradlew.bat --no-daemon testcorepack pnpm -C web lintcorepack pnpm -C web typecheckcorepack pnpm -C web buildListObjects.
/loginwithout HTTP400.
Summary by CodeRabbit
Performance
Security
/login.Documentation