Backend table db structure by Artuomka · Pull Request #1751 · rocket-admin/rocketadmin

Artuomka · 2026-05-04T07:32:20Z

Summary by CodeRabbit

Bug Fixes
- Updated authorization permissions for the connection database diagram endpoint.

…EditGuard

coderabbitai · 2026-05-04T07:32:33Z

📝 Walkthrough

Walkthrough

The connection diagram retrieval endpoint's authorization guard is changed from ConnectionReadGuard to ConnectionEditGuard, requiring edit-level permissions instead of read-level permissions to fetch the diagram.

Changes

Authorization Guard Update

Layer / File(s)	Summary
Endpoint Authorization `backend/src/entities/connection/connection.controller.ts`	Connection diagram endpoint guard updated from `ConnectionReadGuard` to `ConnectionEditGuard` at the decorator level.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A guard stands tall at the diagram gate,
From Read to Edit—a permission shift's fate!
Only editors now see the schema's delight,
One tiny swap makes the access just right! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Security Check	⚠️ Warning	Authorization guard changed from ConnectionReadGuard to ConnectionEditGuard on GET endpoint, violating least privilege principle.	Revert guard to ConnectionReadGuard since the endpoint retrieves read-only data without performing modifications.
Title check	❓ Inconclusive	The title 'Backend table db structure' is vague and generic, using non-descriptive terms that don't convey what actually changed in the pull request (guard change from ConnectionReadGuard to ConnectionEditGuard).	Consider a more specific title like 'Change authorization guard for connection diagram endpoint' to clearly indicate the main change being made.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch backend_table_db_structure

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Review rate limit: 0/1 reviews remaining, refill in 60 minutes.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

This PR adjusts backend authorization for the connection database-structure diagram endpoint in the connection controller. In the broader codebase, this endpoint serves a read-only schema visualization for an existing connection.

Changes:

Replaced the guard on GET /connection/diagram/:connectionId.
The endpoint now requires ConnectionEditGuard instead of ConnectionReadGuard.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

 		type: ConnectionDiagramResponseDTO,
 	})
-	@UseGuards(ConnectionReadGuard)
+	@UseGuards(ConnectionEditGuard)


coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

backend/src/entities/connection/connection.controller.ts (1)
724-745: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Confirm that restricting diagram retrieval to edit-level users is intentional.

GET /connection/diagram/:connectionId is a pure read operation (no mutations, InTransactionEnum.OFF), yet it is now guarded by ConnectionEditGuard (CedarAction.ConnectionEdit). Every other read-only GET in this controller (e.g., /connection/users/:connectionId) uses ConnectionReadGuard.

Concretely, any user who holds ConnectionRead but not ConnectionEdit will receive a 403 Forbidden when trying to fetch the Mermaid diagram — a capability they previously had.

If the intent is to restrict schema visibility to editors/admins only (reasonable for sensitive schema data), please add a short comment documenting the rationale so future reviewers don't treat it as a bug. If it's unintentional, revert to ConnectionReadGuard:
↩️ Revert to read-level guard
-	`@UseGuards`(ConnectionEditGuard)
+	`@UseGuards`(ConnectionReadGuard)
 	`@Get`('/connection/diagram/:connectionId')
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@backend/src/entities/connection/connection.controller.ts` around lines 724 -
745, The getConnectionDiagram handler (getConnectionDiagram) is currently
protected by ConnectionEditGuard (CedarAction.ConnectionEdit) which blocks users
with only ConnectionRead permission; either document this intentional
restriction by adding an inline comment above the
`@UseGuards`(ConnectionEditGuard) explaining why diagram access requires
edit-level rights, or if that was unintentional change, replace
ConnectionEditGuard with ConnectionReadGuard so read-only users can access the
diagram; update the annotation/comment adjacent to getConnectionDiagram to
reflect the chosen policy.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@backend/src/entities/connection/connection.controller.ts`:
- Around line 724-745: The getConnectionDiagram handler (getConnectionDiagram)
is currently protected by ConnectionEditGuard (CedarAction.ConnectionEdit) which
blocks users with only ConnectionRead permission; either document this
intentional restriction by adding an inline comment above the
`@UseGuards`(ConnectionEditGuard) explaining why diagram access requires
edit-level rights, or if that was unintentional change, replace
ConnectionEditGuard with ConnectionReadGuard so read-only users can access the
diagram; update the annotation/comment adjacent to getConnectionDiagram to
reflect the chosen policy.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: fb67201d-f1d9-44de-af02-cf4f110ec8de

📥 Commits

Reviewing files that changed from the base of the PR and between 03ab135 and c5ca153.

📒 Files selected for processing (1)

backend/src/entities/connection/connection.controller.ts

Artuomka added 2 commits May 4, 2026 07:30

fix: update guard for getConnectionDiagram endpoint to use Connection…

d87fd18

…EditGuard

Merge branch 'main' into backend_table_db_structure

c5ca153

Copilot AI review requested due to automatic review settings May 4, 2026 07:32

Artuomka enabled auto-merge May 4, 2026 07:32

Copilot started reviewing on behalf of Artuomka May 4, 2026 07:32 View session

Copilot AI reviewed May 4, 2026

View reviewed changes

Comment thread backend/src/entities/connection/connection.controller.ts

type: ConnectionDiagramResponseDTO,

})

@UseGuards(ConnectionReadGuard)

@UseGuards(ConnectionEditGuard)

coderabbitai Bot reviewed May 4, 2026

View reviewed changes

Artuomka merged commit 6795766 into main May 4, 2026
22 of 23 checks passed

Artuomka deleted the backend_table_db_structure branch May 4, 2026 07:45

coderabbitai Bot mentioned this pull request May 18, 2026

feat: add timeout decorator to connection and table schema controllers; configure knex connection pool #1783

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Backend table db structure#1751

Backend table db structure#1751
Artuomka merged 2 commits into
mainfrom
backend_table_db_structure

Artuomka commented May 4, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 4, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

Copilot AI left a comment

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Artuomka commented May 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Artuomka commented May 4, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 4, 2026 •

edited

Loading