Remove authentication specification and add configuration for file-based authentication#2204
Conversation
Thushani-Jayasekera
commented
Jun 16, 2026
Thushani-Jayasekera
commented
- Deleted the authentication specification document as it is no longer needed.
- Introduced a new configuration file for the Platform API, enabling file-based authentication with user management capabilities.
- Updated README for local development instructions, providing two options for running the AI Workspace and Platform API.
- Adjusted environment variable settings in the AI Workspace to route API calls through a proxy, enhancing security with self-signed certificates.
…sed authentication - Deleted the authentication specification document as it is no longer needed. - Introduced a new configuration file for the Platform API, enabling file-based authentication with user management capabilities. - Updated README for local development instructions, providing two options for running the AI Workspace and Platform API. - Adjusted environment variable settings in the AI Workspace to route API calls through a proxy, enhancing security with self-signed certificates.
Thushani-Jayasekera
requested review from
AnuGayan,
Arshardh,
CrowleyRajapakse,
HeshanSudarshana,
HiranyaKavishani,
Krishanx92,
PasanT9,
RakhithaRR,
Tharsanan1,
VirajSalaka,
ashera96,
chamilaadhi,
dushaniw,
hisanhunais,
malinthaprasan,
pubudu538,
renuka-fernando,
senthuran16,
tgtshanika,
tharikaGitHub and
tharindu1st
as code owners
📝 WalkthroughChangesThis PR removes the authentication specification document and introduces a new file-based authentication configuration for the Platform API, along with updates to the AI Workspace local development setup. Files ChangedRemoved:
Added/Modified:
ImpactThe changes enable developers to run the AI Workspace and Platform API using either a containerized Docker approach or a local development approach with proxy-based API routing. The new file-based authentication configuration provides a quickstart option without requiring external identity providers. WalkthroughThis PR sets up a local development quickstart for file-based authentication. A new Suggested Reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
portals/ai-workspace/src/config.env.ts (1)
160-163: ⚡ Quick winConsider adding a comment to document the proxy routing change.
The PORTAL_API_BASE_URL change mirrors the PLATFORM_API_BASE_URL pattern (relative path via
/api-proxy/proxy), but lacks the explanatory comment present at line 144. Adding a brief comment would improve consistency and help future maintainers understand the routing strategy.export const PORTAL_API_BASE_URL = getEnvOrDefault( 'VITE_PORTAL_API_BASE_URL', + // Portal API routed via /api-proxy proxy (avoids self-signed TLS cert warnings) '/api-proxy/api/portal/v1' );🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@portals/ai-workspace/src/config.env.ts` around lines 160 - 163, Add a comment above the PORTAL_API_BASE_URL constant to document the proxy routing strategy. Mirror the explanatory comment pattern used for PLATFORM_API_BASE_URL by describing that this configuration uses a relative path with the /api-proxy/ proxy for routing API requests. This improves code clarity and consistency for future maintainers understanding the routing approach.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@platform-api/src/config/config.toml`:
- Around line 29-39: The database configuration in the [database] section of
config.toml is entirely commented out, which causes the Driver field to be empty
and triggers an error in the NewConnection function in connection.go:104 when it
encounters an unsupported (empty) database driver. Uncomment either the SQLite
configuration (driver = "sqlite3" and path = "/app/data/api_platform.db") or the
PostgreSQL configuration (host, port, name, user, password, ssl_mode) in the
[database] section so that the Platform API can initialize with a valid database
driver.
- Around line 67-70: The admin user's password_hash in the
[[auth.file_based.users]] section uses the $2y$ prefix (htpasswd format), but
the authentication handler's test cases expect the Go-native $2a$ format.
Regenerate the password hash using a Go-native bcrypt tool to produce a hash
with the $2a$ prefix instead of $2y$, ensuring consistency across the codebase.
---
Nitpick comments:
In `@portals/ai-workspace/src/config.env.ts`:
- Around line 160-163: Add a comment above the PORTAL_API_BASE_URL constant to
document the proxy routing strategy. Mirror the explanatory comment pattern used
for PLATFORM_API_BASE_URL by describing that this configuration uses a relative
path with the /api-proxy/ proxy for routing API requests. This improves code
clarity and consistency for future maintainers understanding the routing
approach.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 5d17d53c-789c-4542-81b5-fb588164f0b5
📒 Files selected for processing (4)
platform-api/spec/authentication.mdplatform-api/src/config/config.tomlportals/ai-workspace/README.mdportals/ai-workspace/src/config.env.ts
💤 Files with no reviewable changes (1)
- platform-api/spec/authentication.md
| [[auth.file_based.users]] | ||
| username = "admin" | ||
| password_hash = "$2y$10$U2yKMwGamGwDoMu0hRPT7u8nCuP8z/qxHFOKV6dhIxkJN9NJ0eVQ." | ||
| scopes = "ap:organization:manage ap:gateway:manage ap:gateway_custom_policy:manage ap:rest_api:manage ap:llm_provider:manage ap:llm_proxy:manage ap:mcp_proxy:manage ap:webbroker_api:manage ap:websub_api:manage ap:application:manage ap:subscription:manage ap:subscription_plan:manage ap:project:manage ap:llm_template:manage ap:devportal:manage ap:git:read ap:api_key:read" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check Go crypto/bcrypt documentation and auth handler code.
# Expected: Confirmation that CompareHashAndPassword works with $2y$ format.
grep -n "bcrypt.CompareHashAndPassword" platform-api/src/internal/handler/auth_login.go
go doc golang.org/x/crypto/bcrypt | grep -i "2y\|2a\|2b" || echo "Check Go bcrypt source for format support"Repository: wso2/api-platform
Length of output: 343
Regenerate bcrypt hash with Go-native format.
The admin password hash uses $2y$ prefix (standard for htpasswd), but the authentication handler's test cases use $2a$ format. For consistency with the codebase's explicit use of $2a$ format, regenerate this hash with a Go-native bcrypt tool rather than htpasswd.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@platform-api/src/config/config.toml` around lines 67 - 70, The admin user's
password_hash in the [[auth.file_based.users]] section uses the $2y$ prefix
(htpasswd format), but the authentication handler's test cases expect the
Go-native $2a$ format. Regenerate the password hash using a Go-native bcrypt
tool to produce a hash with the $2a$ prefix instead of $2y$, ensuring
consistency across the codebase.
…settings - Changed the default value of the `VITE_DOMAIN` environment variable from `localhost:3009` to `localhost:5380` in both the configuration documentation and the source environment file.
2 participants
