Conversation
ivicac
commented
Jul 5, 2026
ivicac
commented
Contributor
- 1051 Add EE permission scope and role constants
- 1051 Add UserService.getUser(String) login lookup
- 1051 Move WorkspaceUser from CE to EE with audit and custom-role columns
- 1051 Add EE PermissionService with scope registry and tenant-scoped cache
- 1051 Add EE remote PermissionService client
- 1051 Add embedded skip-authorization aspect and filter
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces an Enterprise Edition (EE) permission/RBAC layer for the automation configuration domain (workspace roles + scope registry + tenant-aware caching), adds embedded-mode mechanisms to bypass automation RBAC safely, and extends the platform UserService API with a login-based lookup.
Changes:
- Added
UserService.getUser(String login)and implemented it in the platform user service (and stubbed it in the EE remote client). - Moved
WorkspaceUserand related membership logic from CE into EE, adding audit events, role/custom-role columns, and membership mutation APIs. - Added EE
PermissionServiceimplementation with scope registry + workspace-scope cache (tenant-keyed) and embedded “skip authorization” aspect/filter, plus tests.
Reviewed changes
Copilot reviewed 38 out of 38 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| server/libs/platform/platform-user/platform-user-service/src/main/java/com/bytechef/platform/user/service/UserServiceImpl.java | Adds login-based getUser(String) implementation. |
| server/libs/platform/platform-user/platform-user-api/src/main/java/com/bytechef/platform/user/service/UserService.java | Extends API with getUser(String login). |
| server/libs/automation/automation-configuration/automation-configuration-service/src/main/java/com/bytechef/automation/configuration/service/WorkspaceUserServiceImpl.java | Removes CE workspace-user service implementation (moved to EE). |
| server/libs/automation/automation-configuration/automation-configuration-service/src/main/java/com/bytechef/automation/configuration/repository/WorkspaceUserRepository.java | Removes CE workspace-user repository (moved to EE). |
| server/libs/automation/automation-configuration/automation-configuration-service/src/main/java/com/bytechef/automation/configuration/facade/WorkspaceFacadeImpl.java | Reworks getUserWorkspaces authorization and implementation. |
| server/libs/automation/automation-configuration/automation-configuration-api/src/main/java/com/bytechef/automation/configuration/service/WorkspaceUserService.java | Removes CE workspace-user service API (moved to EE). |
| server/libs/automation/automation-configuration/automation-configuration-api/src/main/java/com/bytechef/automation/configuration/security/constant/WorkspaceRoleType.java | Updates marker-interface documentation for role enums. |
| server/libs/automation/automation-configuration/automation-configuration-api/src/main/java/com/bytechef/automation/configuration/domain/WorkspaceUser.java | Removes CE WorkspaceUser domain model (moved to EE). |
| server/ee/libs/platform/platform-user/platform-user-remote-client/src/main/java/com/bytechef/ee/platform/user/remote/client/service/RemoteUserServiceClient.java | Adds stub for new getUser(String) method in remote client. |
| server/ee/libs/embedded/embedded-security-web/embedded-security-web-impl/src/test/java/com/bytechef/ee/embedded/security/web/filter/EmbeddedAutomationAuthorizationSkipFilterTest.java | Adds unit tests for embedded skip filter behavior and cleanup. |
| server/ee/libs/embedded/embedded-security-web/embedded-security-web-impl/src/main/java/com/bytechef/ee/embedded/security/web/filter/EmbeddedAutomationAuthorizationSkipFilter.java | Adds request-scoped automation RBAC bypass for embedded authentication. |
| server/ee/libs/embedded/embedded-security-web/embedded-security-web-impl/src/main/java/com/bytechef/ee/embedded/security/web/configurer/EmbeddedApiKeySecurityConfigurer.java | Registers the embedded skip filter in the embedded API key security chain. |
| server/ee/libs/embedded/embedded-security-web/embedded-security-web-impl/build.gradle.kts | Adds dependency required by embedded skip filter (automation-configuration-api). |
| server/ee/libs/embedded/embedded-configuration/embedded-configuration-service/src/test/java/com/bytechef/ee/embedded/configuration/security/SkipAutomationAuthorizationAspectIntTest.java | Adds integration test ensuring skip aspect sets/clears context correctly. |
| server/ee/libs/embedded/embedded-configuration/embedded-configuration-service/src/main/java/com/bytechef/ee/embedded/configuration/security/SkipAutomationAuthorizationAspect.java | Adds EE AOP aspect to enable skip mode for annotated beans/methods. |
| server/ee/libs/embedded/embedded-configuration/embedded-configuration-service/build.gradle.kts | Adds AspectJ weaver dependency for the skip-authorization aspect. |
| server/ee/libs/automation/automation-configuration/automation-configuration-service/src/test/java/com/bytechef/ee/automation/configuration/service/WorkspaceScopeCacheServiceTest.java | Adds unit tests for cache eviction semantics and transaction synchronization behavior. |
| server/ee/libs/automation/automation-configuration/automation-configuration-service/src/test/java/com/bytechef/ee/automation/configuration/service/WorkspaceScopeCacheKeyConsistencyTest.java | Adds test pinning eviction key consistency with the configured tenant key generator. |
| server/ee/libs/automation/automation-configuration/automation-configuration-service/src/test/java/com/bytechef/ee/automation/configuration/service/PermissionServiceTest.java | Adds unit tests for EE permission service behavior and skip-mode semantics. |
| server/ee/libs/automation/automation-configuration/automation-configuration-service/src/test/java/com/bytechef/ee/automation/configuration/service/PermissionScopeRegistryTest.java | Adds tests for scope aggregation, tiering, and conflict detection. |
| server/ee/libs/automation/automation-configuration/automation-configuration-service/src/main/java/com/bytechef/ee/automation/configuration/service/WorkspaceUserServiceImpl.java | Adds EE workspace membership mutation + auditing + cache-eviction logic. |
| server/ee/libs/automation/automation-configuration/automation-configuration-service/src/main/java/com/bytechef/ee/automation/configuration/service/WorkspaceScopeCacheService.java | Adds tenant-aware workspace-scope caching with programmatic eviction. |
| server/ee/libs/automation/automation-configuration/automation-configuration-service/src/main/java/com/bytechef/ee/automation/configuration/service/PermissionServiceImpl.java | Adds EE permission checks (roles/scopes/ownership) with skip-mode short-circuiting. |
| server/ee/libs/automation/automation-configuration/automation-configuration-service/src/main/java/com/bytechef/ee/automation/configuration/service/PermissionScopeRegistry.java | Adds provider-based scope registry and built-in role → scopes mapping. |
| server/ee/libs/automation/automation-configuration/automation-configuration-service/src/main/java/com/bytechef/ee/automation/configuration/service/CurrentUserResolver.java | Adds request-level caching for current-user resolution (login → userId). |
| server/ee/libs/automation/automation-configuration/automation-configuration-service/src/main/java/com/bytechef/ee/automation/configuration/repository/WorkspaceUserRepository.java | Extends EE repository with membership lookups, counts, and deletes. |
| server/ee/libs/automation/automation-configuration/automation-configuration-service/src/main/java/com/bytechef/ee/automation/configuration/exception/WorkspaceUserErrorType.java | Adds structured error types for workspace membership failures. |
| server/ee/libs/automation/automation-configuration/automation-configuration-service/src/main/java/com/bytechef/ee/automation/configuration/audit/WorkspaceUserAuditPublisher.java | Adds EE audit publisher for workspace membership mutations. |
| server/ee/libs/automation/automation-configuration/automation-configuration-service/src/main/java/com/bytechef/ee/automation/configuration/audit/WorkspaceUserAuditEvent.java | Defines audit event types for workspace membership mutations. |
| server/ee/libs/automation/automation-configuration/automation-configuration-service/build.gradle.kts | Adds dependencies needed for EE permission service/caching/auditing. |
| server/ee/libs/automation/automation-configuration/automation-configuration-remote-client/src/main/java/com/bytechef/ee/automation/configuration/remote/client/service/RemotePermissionServiceClient.java | Adds remote PermissionService stub that fails closed with operator-visible logs. |
| server/ee/libs/automation/automation-configuration/automation-configuration-api/src/test/java/com/bytechef/ee/automation/configuration/security/constant/WorkspaceRoleTest.java | Pins role hierarchy contract (hasAtLeast). |
| server/ee/libs/automation/automation-configuration/automation-configuration-api/src/test/java/com/bytechef/ee/automation/configuration/security/constant/EnumOrdinalPinTest.java | Pins enum ordinals/privilege ranks (DB compatibility). |
| server/ee/libs/automation/automation-configuration/automation-configuration-api/src/main/java/com/bytechef/ee/automation/configuration/service/WorkspaceUserService.java | Adds EE workspace-user service API for membership operations. |
| server/ee/libs/automation/automation-configuration/automation-configuration-api/src/main/java/com/bytechef/ee/automation/configuration/service/CustomRoleScopeResolver.java | Adds SPI for resolving scopes from custom role IDs. |
| server/ee/libs/automation/automation-configuration/automation-configuration-api/src/main/java/com/bytechef/ee/automation/configuration/security/PermissionScopeProvider.java | Adds SPI for modules to contribute permission scope definitions. |
| server/ee/libs/automation/automation-configuration/automation-configuration-api/src/main/java/com/bytechef/ee/automation/configuration/security/constant/WorkspaceRole.java | Adds EE workspace role enum + privilege rank + tier comparison. |
| server/ee/libs/automation/automation-configuration/automation-configuration-api/src/main/java/com/bytechef/ee/automation/configuration/domain/WorkspaceUser.java | Adds EE WorkspaceUser with built-in/custom-role XOR invariant + audit columns. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- WorkspaceFacadeImpl.getUserWorkspaces: restore per-user filtering that was lost when WorkspaceUser moved CE->EE. Orchestrate WorkspaceService + PermissionService (permissive in CE, membership-scoped in EE) so a non-admin only sees workspaces they hold a role in; tenant admins see all. - WorkspaceScopeCacheService/PermissionServiceImpl: bounds-check the workspace_role ordinal so a corrupted/legacy value fails closed (deny) instead of throwing ArrayIndexOutOfBoundsException as a 500. - WorkspaceUserService: align removeWorkspaceUser Javadoc with the actual throw-on-non-member behavior. - Add unit tests for the filtering and fail-closed paths. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.