feat(core): Global RBAC Initial commit by RVANDO12 · Pull Request #158 · Decathlon/internal-developer-platform

RVANDO12 · 2026-09-29T08:11:12Z

PR Description

What this PR Provides

This pull request introduces a comprehensive authorization model for the IDP-Core platform, focusing on a principal entity template and enforcing stricter access control for sensitive operations. It adds new domain models for authorization, a global authorization service, and updates to principal provisioning logic. Additionally, documentation is updated to reflect these security enhancements and constraints.

Adds Phase 1 GLOBAL authorization to the JWT, OAuth2 login, and mock API security chains.
Grants platform-wide CRUD access to configured break-glass principals and principals whose principal entity has is_admin: true.
Restricts human principals to read operations by default. An optional property-based gate can further restrict human access: when configured, the named principal property must be true for access to protected API endpoints, including reads. When unset, the gate is disabled.
Add Provisoning flag to chosse between JIT or LINK_ONLY.
Allows service accounts Read operations.
Keeps webhook ingestion on its existing connector-level security. Trusted ingestion mappings can update principal properties such as is_admin and the configured human-access property.

Authorization Model and Enforcement:

Added new domain models for authorization, including AuthorizationAction, AuthorizationMode, AuthorizationPolicy, AuthorizationRequest, and AuthorizationResource, to standardize how authorization is described and enforced in the domain layer. [1] [2] [3] [4] [5]
Introduced GlobalAuthorizationService to enforce global authorization policies, including catalog administrator checks, break-glass bypass, and property-based access control, throwing PrincipalNotAuthorizedException on violations. [1] [2]

Principal Entity Protection and Provisioning:

Updated PrincipalProvisioningService to support provisioning global administrator principals, ensure correct property assignment (kind, is_admin), and only return principals matching the authenticated actor's kind.

Validation and Error Handling:

Added new validation messages and helper methods for authorization-related null checks in ValidationMessages. [1] [2]
Clarified the error response format in documentation, specifying that security filter errors must use the same structure.

Documentation Updates:

Documented that only catalog administrators can create the protected principal template and mappings targeting it, and clarified the security rationale. [1] [2]

Audit Identity Provider Port:

Added AuditIdentityProviderPort interface to provide authenticated identity information for audit revisions.

How to test

Initial state

Configure and deploy an instace with IDP_SUPER_ADMIN_IDENTIFIER, IDP_AUTH_JWT_HUMAN_INDICATOR_CLAIM, IDP_AUTH_JWT_HUMAN_ID_CLAIM, IDP_AUTH_JWT_MACHINE_ID_CLAIM variables.
Start IDP-Core with a database and the required catalog templates, including a principal template with a Boolean is_admin property.

Scenarios

Upon first connection, the IDP_SUPER_ADMIN_IDENTIFIER should be able to be created as a Principal with the is_admin property set to true.
The IDP_SUPER_ADMIN_IDENTIFIER should be able to create new Principal entities.
The IDP_SUPER_ADMIN_IDENTIFIER should be able to update the is_admin property for other users.
(LINK_ONLY provisoning mode) A user who tries to connect with a valid token but with a non-existent Principal should be denied access (or: should have access denied).
(JIT provisoning mode) A user who tries to connect with a valid token but with a non-existent Principal should be allowed and a Principal should be provisioned using the token information.
A user who makes a request with a valid token and an existing Principal with the is_admin property set to false should be able to read the Catalog and search, but not write to or access any webhook, dynamic Entity Mapping, or Audit endpoints.
A user who makes a request with a valid token and an existing Principal with the is_admin property set to true should be able to access all endpoints without restriction.

Breaking changes

Behavior modification: Authenticated humans no longer receive write access through a wildcard baseline authority. They are read-only by default unless promoted to platform admin.
Optional access gate: When IDP_REQUIRED_PRINCIPAL_PROPERTY is set, humans need the named principal property set to true to access protected API endpoints. When unset, this extra condition is disabled.
Principal identifiers: Human principals now use the configured identifier claim. Existing entities keyed by another claim are not renamed or merged, and their is_admin property is not carried over automatically.
Configuration: Break-glass variables use IDP_SUPER_ADMIN_IDENTIFIER; deployments must provide values matching the resulting principal identifiers.
API JSON schema modification: N/A.

github-code-quality · 2026-09-29T08:15:10Z

Code coverage overview

Languages: Java

Java / code-coverage/jacoco

main 7c584be	feat/RABC/step_1_glo... 018aef6	+/-
91%	91%	0%

View coverage of the 10 most impacted files.

File	main 7c584be	feat/RABC/step_1_glo... 018aef6	+/-
`com/decathlon/i...estFactory.java`	0%	92%	+92%
`com/decathlon/i...tionFilter.java`	0%	100%	+100%
`com/decathlon/i...Properties.java`	0%	100%	+100%
`com/decathlon/i...ionService.java`	0%	100%	+100%
`com/decathlon/i...tionPolicy.java`	0%	100%	+100%
`com/decathlon/i...ionRequest.java`	0%	100%	+100%
`com/decathlon/i...Properties.java`	0%	100%	+100%
`com/decathlon/i...onResource.java`	0%	100%	+100%
`com/decathlon/i...figuration.java`	0%	100%	+100%
`com/decathlon/i...onseWriter.java`	0%	100%	+100%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

_{Updated October 23, 2026 14:37 UTC}

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved authorization bypasses can grant service accounts unintended privileges, including platform-admin access.

Review effort: Balanced
Findings: 3 · 4

Open (7)

Service name claim alone grants service-account write privileges · New
Service account can self-promote via ingestion mapping and connector updates · New
Protected principal template creation bypasses authorization · New
Missing identifier claim causes server error instead of 401 · New
Authorization denials omit standard API error response fields · New
Mock authentication fails when configured identifier claim differs · New
Local profile overrides environment-configured identifier claim · New

What changed in this PR

Introduces Phase 1 global authorization for IDP-Core’s catalog APIs, replacing permissive baseline access with principal-based policies.

Changes:

Adds authorization policies, controller resource metadata, and security-chain enforcement.
Configures human identifiers and provisions principals without admin privileges.
Updates security tests, integration fixtures, and authentication documentation.

File	Description
`src/test/resources/db/test/R__6_insert_principal_user_for_test.sql`	Adds principal fixtures for authorization tests.
`src/test/resources/db/test/R__1_Insert_test_data.sql`	Adds an optional access-gate property.
`src/test/resources/application-test.yml`	Removes wildcard baseline configuration.
`src/test/java/com/decathlon/idp_core/SecurityConfigurationTest.java`	Checks removal of universal authority.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/handler/ApiExceptionHandlerTest.java`	Tests authorization exception mapping.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/controller/PrincipalControllerTest.java`	Tests standard human read access.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/controller/InboundWebhookManagementControllerTest.java`	Tests denied human webhook creation.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/controller/EntityTemplateControllerTest.java`	Seeds authorized principals for integration tests.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/controller/EntityDynamicMappingControllerTest.java`	Adds principal fixtures and adjusts payload escaping.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/controller/AuditControllerTest.java`	Uses admin principals for lifecycle tests.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/SecurityRolePropertiesTest.java`	Deletes obsolete baseline-role tests.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/PublicFilterChainConfigTest.java`	Updates authentication configuration construction.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/OAuth2LoginFilterChainConfigTest.java`	Checks authorization filter placement.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/MockFilterChainConfigTest.java`	Checks mock-chain authorization wiring.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/JwtFilterChainConfigTest.java`	Checks JWT-chain authorization wiring.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/AuthorizationConfigurationTest.java`	Tests policy binding and filter registration.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/AuthenticationPropertiesTest.java`	Tests identifier-claim configuration.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/UnifiedUserProviderTest.java`	Tests shared identity extraction.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/TestHandlerMappings.java`	Supplies controller mappings for authorization tests.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/JitProvisioningFilterTest.java`	Checks request-scoped principal sharing.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/GlobalAuthorizationFilterTest.java`	Tests authorization filtering and denial behavior.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/AuthorizationRequestFactoryTest.java`	Tests route-derived actions and resources.
`src/test/java/com/decathlon/idp_core/domain/service/principal/PrincipalProvisioningServiceTest.java`	Checks non-admin provisioning defaults.
`src/test/java/com/decathlon/idp_core/domain/service/principal/PrincipalExtractorTest.java`	Tests configured human identifier extraction.
`src/test/java/com/decathlon/idp_core/domain/service/authorization/GlobalAuthorizationServiceTest.java`	Tests the global authorization matrix.
`src/main/resources/application.yml`	Adds authorization and identifier settings.
`src/main/resources/application-local.yml`	Selects GitHub’s identifier claim locally.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/principal/strategies/OAuth2UserPrincipalExtractionStrategy.java`	Uses configured OAuth2/OIDC identifiers.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/principal/strategies/JwtPrincipalExtractionStrategy.java`	Uses configured human JWT identifiers.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/handler/ApiExceptionHandler.java`	Maps authorization exceptions to 403.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/controller/PrincipalController.java`	Declares the principal resource.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/controller/InboundWebhookConfigurationController.java`	Declares webhook configuration resources.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/controller/EntityTemplateController.java`	Declares template resources.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/controller/EntityGraphController.java`	Declares entity graph resources.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/controller/EntityDynamicMappingController.java`	Marks mapping resources and read-only dry runs.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/controller/EntityController.java`	Marks entity resources and read-only searches.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/controller/AuditController.java`	Declares audit resources.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/SecurityRoleProperties.java`	Deletes baseline-role configuration.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/SecurityConfiguration.java`	Removes wildcard authority assignment.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/OAuth2LoginFilterChainConfig.java`	Enforces authorization after provisioning.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/MockFilterChainConfig.java`	Adds mock-chain authorization enforcement.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/JwtFilterChainConfig.java`	Adds JWT-chain authorization enforcement.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/AuthorizationProperties.java`	Binds external authorization settings.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/AuthorizationConfiguration.java`	Builds the domain policy and controls registration.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/AuthenticationProperties.java`	Adds the human identifier-claim setting.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/UnifiedUserProvider.java`	Aligns audit identities with principal extraction.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/ProvisionedPrincipalContext.java`	Shares provisioned principals within requests.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/JitProvisioningFilter.java`	Exposes provisioning results to authorization.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/GlobalAuthorizationFilter.java`	Enforces the global policy on authenticated requests.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/AuthorizedResource.java`	Defines controller resource metadata.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/AuthorizationRequestFactory.java`	Derives authorization context from MVC mappings.
`src/main/java/com/decathlon/idp_core/domain/service/principal/PrincipalProvisioningService.java`	Defaults new principals to non-admin.
`src/main/java/com/decathlon/idp_core/domain/service/authorization/GlobalAuthorizationService.java`	Implements global access decisions.
`src/main/java/com/decathlon/idp_core/domain/model/authorization/AuthorizationResource.java`	Models resource identifiers and parent context.
`src/main/java/com/decathlon/idp_core/domain/model/authorization/AuthorizationRequest.java`	Models principal, action, and resource input.
`src/main/java/com/decathlon/idp_core/domain/model/authorization/AuthorizationPolicy.java`	Stores immutable authorization policy settings.
`src/main/java/com/decathlon/idp_core/domain/model/authorization/AuthorizationMode.java`	Defines current and future policy modes.
`src/main/java/com/decathlon/idp_core/domain/model/authorization/AuthorizationAction.java`	Defines supported authorization actions.
`src/main/java/com/decathlon/idp_core/domain/exception/authorization/PrincipalNotAuthorizedException.java`	Represents denied domain operations.
`docs/src/concepts/authentication.md`	Documents global policies and identifier configuration.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Copilot review overview

🟡 Changes recommended

Service accounts can still alter or delete protected principal-ingestion configuration.

Review effort: Balanced
Findings: 4 · 1

Open (5)

Authorize resolved target before deleting mappings or webhooks · New
Authorize stored mapping target before replacing principal mapping · New
Protected principal template creation bypasses authorization
Service name claim alone grants service-account write privileges
GitHub OAuth uses incorrect default principal identifier claim · New

Resolved since last review (5)

Service account can self-promote via ingestion mapping and connector updates
Local profile overrides environment-configured identifier claim
Mock authentication fails when configured identifier claim differs
Authorization denials omit standard API error response fields
Missing identifier claim causes server error instead of 401

Copilot

Copilot review overview

🟡 Changes recommended

An unresolved authorization bypass lets service accounts disable protected principal-ingestion connectors.

Review effort: Balanced
Findings: 1

Open (1)

Authorize removal of persisted principal mappings · New

Resolved since last review (5)

Authorize stored mapping target before replacing principal mapping
Authorize resolved target before deleting mappings or webhooks
Protected principal template creation bypasses authorization
Service name claim alone grants service-account write privileges
GitHub OAuth uses incorrect default principal identifier claim

sonarqubecloud · 2026-10-23T14:37:29Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

feat(core): Global RBAC Initial commit

c2ba1e2

RVANDO12 marked this pull request as draft September 29, 2026 08:11

RVANDO12 added 4 commits September 29, 2026 15:23

feat(core): Global RBAC - itegrate actions and rules

0ca53eb

feat(core): Global RBAC - update doc

573abae

feat(core): Global RBAC - prepare step following

8a614d8

feat(core): Global RBAC - cleaning logic

f11fa24

RVANDO12 requested a balanced review from Copilot October 2, 2026 11:49

Copilot started reviewing on behalf of RVANDO12 October 2, 2026 11:50

View session

feat(core): Global RBAC - vale issue

5d895a8

Copilot AI reviewed Oct 2, 2026

View reviewed changes

feat(core): Global RBAC - fix copilot issue

c71a220

RVANDO12 requested a balanced review from Copilot October 5, 2026 07:12

Copilot started reviewing on behalf of RVANDO12 October 5, 2026 07:13

View session

Copilot AI reviewed Oct 5, 2026

View reviewed changes

Comment thread ...ain/java/com/decathlon/idp_core/domain/service/authorization/GlobalAuthorizationService.java Outdated

Comment thread ...ecathlon/idp_core/infrastructure/adapters/api/controller/EntityDynamicMappingController.java

Comment thread src/main/resources/application-local.yml Outdated

RVANDO12 added 2 commits October 5, 2026 10:12

feat(core): Global RBAC - fix copilot issue

ec085d8

feat(core): Global RBAC - fix copilot issue

c2186cb

RVANDO12 requested a balanced review from Copilot October 5, 2026 08:25

Copilot started reviewing on behalf of RVANDO12 October 5, 2026 08:26

View session

Copilot AI reviewed Oct 5, 2026

View reviewed changes

Comment thread ...n/idp_core/infrastructure/adapters/api/controller/InboundWebhookConfigurationController.java Outdated

RVANDO12 added 2 commits October 5, 2026 14:12

fix: CBC-999 - remove useless security

5a5d669

feat(core): Global RBAC - fix test fail

ef89757

RVANDO12 marked this pull request as ready for review October 5, 2026 14:26

RVANDO12 and others added 7 commits October 7, 2026 11:26

Merge branch 'main' into feat/RABC/step_1_global

381c0b4

Merge branch 'main' into feat/RABC/step_1_global

41f120f

feat(core): Global RBAC

05125b4

Merge branch 'main' into feat/RABC/step_1_global

858bc7b

feat(core): GLOBAL RBAC - update right matrix - add provisioning flag

565e44f

feat(core): GLOBAL RBAC - update right matrix and principal provisioning

e4a4866

GLOBAL RBAC - update right matrix and principal provisioning

539099d

github-code-quality Bot found potential problems Oct 21, 2026

View reviewed changes

Comment thread ...java/com/decathlon/idp_core/domain/service/authorization/GlobalAuthorizationServiceTest.java Fixed

Comment thread .../java/com/decathlon/idp_core/infrastructure/adapters/api/auth/JitProvisioningFilterTest.java Fixed

brandPittCode added 7 commits October 21, 2026 17:17

GLOBAL RBAC - update right matrix and principal provisioning

3319e54

GLOBAL RBAC - update right matrix and principal provisioning

226798c

GLOBAL RBAC - update right matrix and principal provisioning

bea2935

GLOBAL RBAC - update right matrix and principal provisioning

7783c56

GLOBAL RBAC - update right matrix and principal provisioning

8fc656e

Merge branch 'main' into feat/RABC/step_1_global

140f179

GLOBAL RBAC - update right matrix and principal provisioning

99eb49c

evebrnd reviewed Oct 22, 2026

View reviewed changes

brandPittCode added 9 commits October 23, 2026 10:20

GLOBAL RBAC - update right matrix and principal provisioning

ad6fa99

feat(core): GLOBAL RBAC - update right matrix and principal provisioning

94fd77e

feat(core): GLOBAL RBAC - update right matrix and principal provisioning

c946bf8

feat(core): GLOBAL RBAC - update right matrix and principal provisioning

5efe8f2

feat(core): GLOBAL RBAC - update right matrix and principal provisioning

5a5fd2a

feat(core): GLOBAL RBAC - update right matrix and principal provisioning

6dc8369

feat(core): GLOBAL RBAC - update right matrix and principal provisioning

8251b57

feat(core): GLOBAL RBAC - update right matrix and principal provisioning

44800d3

feat(core): GLOBAL RBAC - update right matrix and principal provisioning

8b7b9bc

evebrnd approved these changes Oct 23, 2026

View reviewed changes

brandPittCode added 2 commits October 23, 2026 16:16

feat(core): GLOBAL RBAC - update right matrix and principal provisioning

7175de8

feat(core): GLOBAL RBAC - update right matrix and principal provisioning

018aef6

brandPittCode merged commit cd0dfc4 into main Oct 23, 2026
20 checks passed

brandPittCode deleted the feat/RABC/step_1_global branch October 23, 2026 15:01

Conversation

RVANDO12 commented Sep 29, 2026 • edited by brandPittCode Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Description

What this PR Provides

How to test

Initial state

Scenarios

Breaking changes

Uh oh!

github-code-quality Bot commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code coverage overview

Java / code-coverage/jacoco

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Oct 23, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

RVANDO12 commented Sep 29, 2026 •

edited by brandPittCode

Loading

github-code-quality Bot commented Sep 29, 2026 •

edited

Loading