UN-3638 [TEST] Cover the Platform API key branch of CustomAuthMiddleware - #2223
Merged
Merged
Conversation
The Bearer branch decides organization scoping and permission tier vs HTTP method before any view runs, and had no test in either tree. Drives a real middleware chain so those decisions are exercised where they are made. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TgRHmXGEFLbPZTG7ewyvhM
|
Contributor
|
| Filename | Overview |
|---|---|
| backend/platform_api/tests/test_platform_key_middleware.py | Adds focused request-level tests for Platform API key validation, tenant and permission boundaries, request binding, and CSRF handling; no actionable defect was identified. |
| backend/platform_api/tests/init.py | Marks the new platform_api test directory as a Python package without introducing runtime behavior. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
Request[Bearer request with organization URL] --> Org[OrganizationMiddleware resolves organization]
Org --> Auth[CustomAuthMiddleware validates Platform API key]
Auth --> KeyChecks{Key valid and active?}
KeyChecks -->|No| Unauthorized[401 response]
KeyChecks -->|Yes| OrgCheck{Key belongs to organization?}
OrgCheck -->|No| ForbiddenOrg[403 response]
OrgCheck -->|Yes| TierCheck{Permission allows HTTP method?}
TierCheck -->|No| ForbiddenMethod[403 response]
TierCheck -->|Yes| Bind[Bind service-account user and key; opt out of CSRF]
Bind --> View[Test echo view]
Reviews (1): Last reviewed commit: "[TEST] Cover the Platform API key branch..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
chandrasekharan-zipstack
changed the title
Contributor
Summary by CodeRabbit
WalkthroughAdded request-level tests for ChangesPlatform API-key authentication
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Unstract test resultsPer-group results
Critical paths
|
Deepak-Kesavan
added a commit
that referenced
this pull request
Aug 3, 2026
Picks up ResourceTable (frontend/src/components/widgets/resource-table/), which cloud main's agentic-prompt-studio plugin imports — without it the Cloud Frontend image fails to build: Could not resolve "../../../components/widgets/resource-table/ResourceTable" from "src/plugins/agentic-prompt-studio/pages/Projects.jsx" Also brings in #2223, which covers the Platform API key branch of CustomAuthMiddleware — the auth path the platform MCP server relies on.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds request-level tests for the Platform API key (Bearer) branch of
CustomAuthMiddleware—backend/account_v2/custom_auth_middleware.py:70-146.Why
This branch is the only way a caller authenticates without a session, and it carries authorization decisions that the views behind it do not repeat:
request.csrf_processing_done = True)Both 403s are tenant/privilege boundaries, and neither had a single test —
platform_api/had notests/directory at all. The tier logic (UN-3405,full_accessfor DELETE) and the rotation permission gate (UN-3586) both landed untested.Note
api-deployment-authdoes not cover this despite the name: it testsapi_v2.APIKeyvia thevalidate_api_keydecorator withAPIRequestFactory(no middleware), and/deployment/is whitelisted so the middleware returns before reaching the Bearer branch.How
Real middleware chain (trimmed from production, relative order preserved) plus a throwaway DRF view, so
OrganizationMiddlewarepopulatesrequest.organization_idfrom the URL exactly as it does in production.MIDDLEWAREis pinned explicitly rather than inherited, because the cloud test settings dropCustomAuthMiddleware.12 tests: malformed/unknown/inactive key, cross-org key, missing service account, each permission tier against an allowed and a disallowed method, request binding, and the CSRF opt-out (via
APIClient(enforce_csrf_checks=True)).Incidental finding
The "unrecognized permission tier" guard in the middleware is unreachable: a
platform_api_key_permission_validCHECK constraint rejects the write first. The test asserts the constraint instead of the dead branch.🤖 Generated with Claude Code
https://claude.ai/code/session_01TgRHmXGEFLbPZTG7ewyvhM