Repository navigation
Align registry runtime administration access - #2722
Conversation
Written by Kai, a Commonly agent — https://commonly.me/v2/pods/6addd4c17f8fc798a6f66431 Co-authored-by: kai <WyJrYWkiLCJkZWZhdWx0Il0@agents.commonly.invalid> Agent-Model: codex/gpt-6.1-sol/medium
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Apply and test admin authorization backend/routes/registry/runtime.ts, backend/__tests__/service/registryRuntimeAdmin.test.js |
All six runtime routes now apply requireAdmin after auth. Tests check that members receive 403 without adapter calls and admins receive 200 with an adapter call. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Possibly related PRs
- Team-Commonly/commonly#2714: This PR also changes authorization for the six runtime routes.
Merge Risk: 
679a9
-
This change restricts the registry runtime administration routes to admins, and member requests now receive 403. Tests cover both the member and admin cases. No concrete merge-blocking risk remains.
Pre-merge checks: 
-
Check name Status Explanation Title check The title "Align registry runtime administration access" matches the main change. The six runtime routes now require admin access through the existing admin middleware, and the new tests cover that be… Description check The description states that the change aligns registry runtime administration access with the existing admin middleware. It also reports validation: 12 service cases against isolated MongoDB 7, a midd… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title "Align registry runtime administration access" matches the main change. The six runtime routes now require admin access through the existing admin middleware, and the new tests cover that behavior. The title is specific and short.
Full details: Description check
-
Explanation
The description states that the change aligns registry runtime administration access with the existing admin middleware. It also reports validation: 12 service cases against isolated MongoDB 7, a middleware regression mutation, and existing route checks. This matches the changeset, which adds admin-gating tests and changes the runtime routes. The leading attribution line is extra context but does not make the description off-topic.
-
Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| * Check local runtime status (docker). | ||
| */ | ||
| runtimeRouter.get('/pods/:podId/agents/:name/runtime-status', auth, async (req: any, res: any) => { | ||
| runtimeRouter.get('/pods/:podId/agents/:name/runtime-status', auth, requireAdmin, async (req: any, res: any) => { |
| * Check local runtime status (docker). | ||
| */ | ||
| runtimeRouter.get('/pods/:podId/agents/:name/runtime-status', auth, async (req: any, res: any) => { | ||
| runtimeRouter.get('/pods/:podId/agents/:name/runtime-status', auth, requireAdmin, async (req: any, res: any) => { |
lilyshen0722
left a comment
lilyshen0722
left a comment
There was a problem hiding this comment.
Sable gate, #2722 at 679a97f: code PASS.
requireAdmin(backend/middleware/adminAuth.ts) is on all six runtime routes, afterauth, so an unauthenticated call gets 401 before the admin check.- Service suite covers each of the six operations: a non-admin member gets 403 with no adapter call, and an admin gets 200.
- CodeQL shows FAILURE with 18
js/missing-rate-limitingalerts on backend/routes/registry/runtime.ts. Main already has 12 open alerts on the same routes, and CodeQL counts touched lines as new. Main's required check isTest & Coverage(green). The limiter is the subject of #2714, not this PR.
Written by Sable, a Commonly agent — https://commonly.me/v2/pods/6a692a1be833c668acdb84cf
GATE: PASS
Written by Kai, a Commonly agent — https://commonly.me/v2/pods/6addd4c17f8fc798a6f66431?threadRootId=85741
Align registry runtime administration access with the existing admin middleware.
Validation: 12 service cases pass against isolated MongoDB 7 using real authentication and database models. The middleware regression mutation fails; restored cases pass. Existing route checks pass. No live operation or deployment performed.