Refactor devportal configs#2794
Merged
Merged
Conversation
Piumal1999
requested review from
AnuGayan,
Arshardh,
CrowleyRajapakse,
HeshanSudarshana,
HiranyaKavishani,
RakhithaRR,
Tharsanan1,
VirajSalaka,
ashera96,
chamilaadhi,
dushaniw,
hisanhunais,
malinthaprasan,
pubudu538,
renuka-fernando,
senthuran16,
tgtshanika,
tharikaGitHub and
tharindu1st
as code owners
July 22, 2026 09:44
Piumal1999
requested review from
Induwara04,
Krishanx92,
PasanT9,
Thushani-Jayasekera,
lasanthaS and
thivindu
as code owners
July 22, 2026 09:44
Contributor
|
Warning Review limit reached
Next review available in: 45 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe Developer Portal configuration is consolidated under ChangesDeveloper Portal migration
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 9
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
portals/developer-portal/src/controllers/authController.js (1)
243-256: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winVerify the Platform API JWT before creating the local-auth session.
The login flow only decodes
platformTokenbefore using its claims and granting a session. WithtlsSkipVerifyenabled, a network attacker can inject a forged token and become authenticated. Verify it withauth.local.publicKeyPathand use only verified claims.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@portals/developer-portal/src/controllers/authController.js` around lines 243 - 256, Update the local-auth login flow around platformToken handling to cryptographically verify the Platform API JWT with the key configured by auth.local.publicKeyPath before creating the local session or trusting any claims. Replace the current decode-only usage with the project’s established JWT verification mechanism, and ensure session creation uses only the verified payload; reject authentication when verification fails.Source: Coding guidelines
portals/developer-portal/src/pages/applications/partials/applications-listing.hbs (1)
51-55: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRemove user data from the inline event handler.
Line 53 injects
displayNameinto a single-quoted JavaScript argument. Handlebars’ HTML escaping is decoded before the handler is compiled, so a quote in an application name can execute script when the delete button is clicked. Store values indata-*attributes and attach the click listener in JavaScript instead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@portals/developer-portal/src/pages/applications/partials/applications-listing.hbs` around lines 51 - 55, Remove displayName from the inline onclick in the delete button within the applications listing template. Store the application id and display name in data attributes, then update the JavaScript initialization for appShowDeleteModal to attach a click listener that reads those attributes and invokes the modal safely.
🧹 Nitpick comments (3)
portals/ai-workspace/docker-compose.yaml (1)
76-102: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winNo healthcheck on the new
developer-portalservice.
platform-apiandai-workspaceboth define healthchecks in this file, and the siblingit/docker-compose.test.postgres.yamldevportal service does too. Adding one here would give consistentdocker compose psvisibility for this optional service.♻️ Suggested healthcheck
ports: - "3000:3000" + healthcheck: + test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:3000/health', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))\""] + interval: 30s + timeout: 5s + start_period: 15s + retries: 3🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@portals/ai-workspace/docker-compose.yaml` around lines 76 - 102, Add a healthcheck to the developer-portal service, matching the existing healthcheck conventions used by platform-api, ai-workspace, and the sibling devportal compose service. Keep it scoped to this optional service and ensure it provides useful docker compose health status.distribution/all-in-one/docker-compose.yaml (1)
55-56: 🔒 Security & Privacy | 🔵 Trivial | ⚖️ Poor tradeoffHardcoded
TLS_SKIP_VERIFY=truedisables cert validation for the platform-api auth client.This blanket-disables TLS certificate verification for the local-auth HTTPS client rather than trusting the specific self-signed CA generated by
platform-api-jwtkeygen/certgen. Practical exposure is limited since this is an internal docker-bridge hop, but it's an insecure default that would be worth tightening (e.g. mount the CA and configure the client to trust it specifically) once that capability exists in the auth client.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@distribution/all-in-one/docker-compose.yaml` around lines 55 - 56, Replace the APIP_DP_AUTH_LOCAL_TLS_SKIP_VERIFY=true configuration with secure CA-specific trust for the platform-api auth client: expose the CA generated by platform-api-jwtkeygen/certgen to the client and configure its trust path using the client’s supported setting. Remove the blanket certificate-verification bypass while preserving HTTPS connectivity to platform-api.portals/ai-workspace/Makefile (1)
244-306: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueMinor:
disttarget body length.Static analysis flags the
distrecipe body as exceeding the configured max length (6 vs 5 lines) — purely stylistic, no functional impact.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@portals/ai-workspace/Makefile` around lines 244 - 306, Reduce the `dist` target recipe body to no more than five lines to satisfy the configured static-analysis limit. Preserve all existing distribution steps and behavior, consolidating commands where appropriate without changing the `dist` target’s output.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@distribution/all-in-one/devportal-config.toml`:
- Around line 44-47: Keep TLS verification enabled by default: in
distribution/all-in-one/devportal-config.toml, update the local auth client
settings around tls_skip_verify to default to false and configure a trusted
Platform API CA/public certificate path. In
tests/integration-e2e/docker-compose.yaml, remove NODE_TLS_REJECT_UNAUTHORIZED=0
and mount/configure the test CA or certificate so webhook HTTPS requests trust
it.
In `@portals/developer-portal/distribution/README.md`:
- Around line 85-93: Correct the configuration paths in the Developer Portal
settings table: change [server.https].enabled to
[developer_portal.server.https].enabled and [organization].default_name to
[developer_portal.organization].default_name, and add the required
[developer_portal.auth.local].public_key_path setting.
In `@portals/developer-portal/it/docker-compose.test.yaml`:
- Around line 79-82: Restrict Developer Portal access to the JWT public key
only: in portals/developer-portal/it/docker-compose.test.yaml at lines 79-82,
bind-mount jwt_public.pem directly into /etc/devportal/keys without exposing the
private key; in tests/integration-e2e/docker-compose.yaml at lines 270-273,
replace the platform-api-jwt-keys mount with a separate public-key file or
public-only volume.
In `@portals/developer-portal/README.md`:
- Around line 272-273: Update the environment-variable mappings in the
configuration table so the IDP variables use the documented authentication
namespace, changing both APIP_DP_IDP_CLIENTID and APIP_DP_IDP_ISSUER mappings
from config.idp to config.auth.idp while preserving their clientId and issuer
fields.
In `@portals/developer-portal/src/controllers/apiWorkflowsController.js`:
- Line 429: Update the URL construction near the workflow controller’s baseUrl
assignment to use a configured public origin instead of combining req.protocol
with the request-controlled req.get('host') value. If configuration is
unavailable, validate the host against an explicit allowlist and ensure trusted
proxy handling is configured before using the protocol; preserve the generated
prompt’s canonical-origin behavior.
In `@portals/developer-portal/src/db/dbSsl.js`:
- Around line 54-55: Update the SSL CA handling around db.sslRootCert to reject
null-byte or traversal input, resolve the certificate path through filesystem
symlinks, and verify the resulting real path remains within the
server-controlled certificate root before reading it with fs.readFileSync;
reject invalid paths rather than loading them.
In `@portals/developer-portal/src/utils/platformJwt.js`:
- Around line 35-40: Update importPublicKeyFromPath to resolve and validate
publicKeyPath against the server-controlled key root before fs.readFile: reject
null-byte or traversal inputs, resolve the candidate path, obtain its realpath,
and require final-path containment within the key root. Only read and cache the
key after all checks pass.
- Around line 39-63: Remove the RSA-based local-auth trust path: replace
verifyPlatformJwtClaims and its importPublicKeyFromPath/RS256 flow with the
approved PQC signature design, and update authMiddleware.js lines 162-167 to
stop using RS256 public-key verification. Update authentication.md lines 64-68,
manage-organizations.md lines 147-153, tests/integration-e2e/README.md lines
148-150, and distribution/README.md lines 44-46 and 102-102 to document the
supported PQC configuration and token-verification wiring, removing RSA
key-generation and RS256 references.
In `@tests/integration-e2e/docker-compose.yaml`:
- Around line 290-293: Update the explanatory comment near the
platform-api/devportal JWT configuration to reference the active
auth.local.public_key_path key instead of auth.local.jwt_public_key, preserving
the surrounding RS256 and shared-keypair details.
---
Outside diff comments:
In `@portals/developer-portal/src/controllers/authController.js`:
- Around line 243-256: Update the local-auth login flow around platformToken
handling to cryptographically verify the Platform API JWT with the key
configured by auth.local.publicKeyPath before creating the local session or
trusting any claims. Replace the current decode-only usage with the project’s
established JWT verification mechanism, and ensure session creation uses only
the verified payload; reject authentication when verification fails.
In
`@portals/developer-portal/src/pages/applications/partials/applications-listing.hbs`:
- Around line 51-55: Remove displayName from the inline onclick in the delete
button within the applications listing template. Store the application id and
display name in data attributes, then update the JavaScript initialization for
appShowDeleteModal to attach a click listener that reads those attributes and
invokes the modal safely.
---
Nitpick comments:
In `@distribution/all-in-one/docker-compose.yaml`:
- Around line 55-56: Replace the APIP_DP_AUTH_LOCAL_TLS_SKIP_VERIFY=true
configuration with secure CA-specific trust for the platform-api auth client:
expose the CA generated by platform-api-jwtkeygen/certgen to the client and
configure its trust path using the client’s supported setting. Remove the
blanket certificate-verification bypass while preserving HTTPS connectivity to
platform-api.
In `@portals/ai-workspace/docker-compose.yaml`:
- Around line 76-102: Add a healthcheck to the developer-portal service,
matching the existing healthcheck conventions used by platform-api,
ai-workspace, and the sibling devportal compose service. Keep it scoped to this
optional service and ensure it provides useful docker compose health status.
In `@portals/ai-workspace/Makefile`:
- Around line 244-306: Reduce the `dist` target recipe body to no more than five
lines to satisfy the configured static-analysis limit. Preserve all existing
distribution steps and behavior, consolidating commands where appropriate
without changing the `dist` target’s output.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 55913ce2-92d2-4d2a-8fd3-81a26d20c4b0
⛔ Files ignored due to path filters (1)
portals/developer-portal/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (73)
distribution/all-in-one/devportal-config.tomldistribution/all-in-one/docker-compose.yamlplatform-api/config/config-template.tomlplatform-api/config/config.goplatform-api/config/config_test.goportals/ai-workspace/Makefileportals/ai-workspace/bff/internal/config/config_test.goportals/ai-workspace/bff/internal/config/settings.goportals/ai-workspace/distribution/README.mdportals/ai-workspace/docker-compose.yamlportals/developer-portal/Makefileportals/developer-portal/README.mdportals/developer-portal/configs/config-template.tomlportals/developer-portal/configs/config.tomlportals/developer-portal/distribution/README.mdportals/developer-portal/docker-compose.platform-api.yamlportals/developer-portal/docker-compose.postgres.yamlportals/developer-portal/docker-compose.yamlportals/developer-portal/docker-entrypoint.shportals/developer-portal/docs/administer/authentication.mdportals/developer-portal/docs/administer/manage-organizations.mdportals/developer-portal/it/docker-compose.test.postgres.yamlportals/developer-portal/it/docker-compose.test.yamlportals/developer-portal/it/test-config.tomlportals/developer-portal/package.jsonportals/developer-portal/scripts/setup.shportals/developer-portal/src/app.jsportals/developer-portal/src/config/configDefaults.jsportals/developer-portal/src/config/configLoader.jsportals/developer-portal/src/config/logger.jsportals/developer-portal/src/controllers/apiContentController.jsportals/developer-portal/src/controllers/apiKeysOverviewController.jsportals/developer-portal/src/controllers/apiKeysPageController.jsportals/developer-portal/src/controllers/apiWorkflowsController.jsportals/developer-portal/src/controllers/applicationsContentController.jsportals/developer-portal/src/controllers/authController.jsportals/developer-portal/src/controllers/customContentController.jsportals/developer-portal/src/controllers/orgContentController.jsportals/developer-portal/src/controllers/subscriptionsContentController.jsportals/developer-portal/src/db/dbPool.jsportals/developer-portal/src/db/dbSsl.jsportals/developer-portal/src/db/sequelizeConfig.jsportals/developer-portal/src/db/sessionStoreConfig.jsportals/developer-portal/src/defaultContent/pages/api-landing/partials/api-subscription-plans.hbsportals/developer-portal/src/defaultContent/pages/apis/partials/api-listing.hbsportals/developer-portal/src/defaultContent/pages/mcp-landing/partials/mcp-subscription-plans.hbsportals/developer-portal/src/defaultContent/pages/mcp/partials/mcp-listing.hbsportals/developer-portal/src/middlewares/authMiddleware.jsportals/developer-portal/src/middlewares/ensureAuthenticated.jsportals/developer-portal/src/middlewares/passportConfig.jsportals/developer-portal/src/middlewares/registerPartials.jsportals/developer-portal/src/pages/api-keys-overview/page.hbsportals/developer-portal/src/pages/api-keys/page.hbsportals/developer-portal/src/pages/api-keys/partials/api-key-list.hbsportals/developer-portal/src/pages/application/partials/api-keys.hbsportals/developer-portal/src/pages/application/partials/keys-token.hbsportals/developer-portal/src/pages/application/partials/manage-keys-km-card.hbsportals/developer-portal/src/pages/application/partials/manage-keys.hbsportals/developer-portal/src/pages/application/partials/overview.hbsportals/developer-portal/src/pages/applications/partials/applications-listing.hbsportals/developer-portal/src/pages/subscriptions/partials/subscription-list.hbsportals/developer-portal/src/scripts/api-keys-overview.jsportals/developer-portal/src/scripts/api-keys-page.jsportals/developer-portal/src/scripts/application-api-keys.jsportals/developer-portal/src/server.jsportals/developer-portal/src/services/apiKeyService.jsportals/developer-portal/src/services/apiWorkflowService.jsportals/developer-portal/src/utils/platformJwt.jsportals/developer-portal/src/utils/tokenUtil.jstests/integration-e2e/README.mdtests/integration-e2e/devportal-config.tomltests/integration-e2e/docker-compose.yamltests/integration-e2e/steps_devportal_test.go
💤 Files with no reviewable changes (11)
- portals/developer-portal/src/scripts/application-api-keys.js
- portals/developer-portal/src/controllers/subscriptionsContentController.js
- portals/developer-portal/src/scripts/api-keys-overview.js
- portals/developer-portal/src/controllers/apiKeysOverviewController.js
- portals/developer-portal/src/controllers/apiKeysPageController.js
- portals/developer-portal/src/pages/application/partials/api-keys.hbs
- portals/developer-portal/src/pages/api-keys/page.hbs
- portals/developer-portal/src/pages/application/partials/manage-keys.hbs
- portals/developer-portal/src/pages/api-keys/partials/api-key-list.hbs
- portals/developer-portal/src/services/apiKeyService.js
- portals/developer-portal/src/scripts/api-keys-page.js
Piumal1999
changed the title
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@portals/developer-portal/src/controllers/authController.js`:
- Around line 279-281: Update the !claims branch in the authentication flow
around verifyPlatformJwtClaims to return HTTP 401 with the exact payload
{"error":"unauthorized","message":"Invalid or expired credentials."} instead of
redirecting to login. Preserve the mandated status and response body for all
invalid, expired, or signature-failed platform JWTs.
- Around line 274-277: Validate the redirect destination in the
missing-public-key branch of the auth controller before using baseUrl, which is
derived from request parameters. Reject unsafe or unvalidated destinations and
redirect to a server-controlled login path or established safe default instead.
In `@portals/developer-portal/src/services/apiWorkflowService.js`:
- Line 382: Update the baseUrl resolution in the API workflow prompt generation
to remove the req.protocol/req.get('host') fallback. Require a configured
canonical origin from config.server.baseUrl, or validate the request host
against an explicit allowlist before using it.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: f07d97d6-c9a5-4e4b-84d3-b42151834744
📒 Files selected for processing (12)
portals/developer-portal/README.mdportals/developer-portal/configs/config-template.tomlportals/developer-portal/configs/config.tomlportals/developer-portal/it/docker-compose.test.yamlportals/developer-portal/src/config/configDefaults.jsportals/developer-portal/src/controllers/apiWorkflowsController.jsportals/developer-portal/src/controllers/authController.jsportals/developer-portal/src/db/dbSsl.jsportals/developer-portal/src/pages/applications/partials/applications-listing.hbsportals/developer-portal/src/services/apiWorkflowService.jsportals/developer-portal/src/utils/platformJwt.jstests/integration-e2e/docker-compose.yaml
🚧 Files skipped from review as they are similar to previous changes (5)
- portals/developer-portal/configs/config-template.toml
- portals/developer-portal/src/config/configDefaults.js
- portals/developer-portal/configs/config.toml
- tests/integration-e2e/docker-compose.yaml
- portals/developer-portal/README.md
lasanthaS
approved these changes
Jul 23, 2026
This was referenced Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Fix #2768
Approach
[developer_portal.*]