feat(rest-api): add Provider-related capabilities to templated iPXE OS and make visible to tenants by pbreton · Pull Request #4067 · NVIDIA/infra-controller

pbreton · 2026-07-24T02:23:41Z

This PR continues implementation of Templated iPXE Operating System in NICo REST API.
Specifically it adds Providers capabilities regarding Templated iPXE Operating System and makes Providers-created OS visible to Tenants.

Related issues

Builds on #3569.

Type of Change

Add - New feature or capability

Breaking Changes

This PR contains breaking changes

Testing

Unit tests added/updated

Add OperatingSystemFilterInput.ProviderOSVisibleAtSiteIDs and rework the OperatingSystemDAO.GetAll owner filtering into an explicit switch covering provider-only, tenant-only, dual-role, and tenant-admin views. The tenant-admin view surfaces provider-owned OSes only when they are associated with one of the tenant's accessible sites. Foundation for provider-admin OS management (PR 4.2/4.3).

Switch the OperatingSystem GetAll and Get handlers to authorize both provider and tenant admins via IsProviderOrTenant, and apply role-based visibility: - Provider admin lists/reads only provider-owned Operating Systems. - Tenant admin additionally sees provider-owned Operating Systems that are associated with a Site the tenant can access (via the new ProviderOSVisibleAtSiteIDs filter). - Dual-role callers see the union. Adds the getTenantSiteIDs helper, handler visibility tests, and restores the provider-admin path in the OpenAPI get-all/get descriptions. Create/Update/ Delete remain tenant-scoped and are handled in a follow-up PR.

Switch the OperatingSystem Create, Update, and Delete handlers to authorize both provider and tenant admins via IsProviderOrTenant and enforce ownership: - Provider admin may only create Provider-owned Operating Systems of type Templated iPXE; ownership (infrastructure_provider_id vs tenant_id) is derived from the caller's role. - Update/Delete require the caller to own the Operating System for their role; cross-owner mutations are rejected with 403. - Name uniqueness and site resolution are scoped to the owner (provider sites for provider-owned, tenant-accessible sites for tenant-owned). Adds write-path ownership tests, updates the two existing tenant-mismatch cases from 400 to 403 to reflect the ownership model, drops the now-unused auth import, and updates the OpenAPI create description for the provider path.

Fold operatingsystem_ownership_test.go and operatingsystem_visibility_test.go into operatingsystem_test.go (handler), and operatingsystem_providervisibility_test.go into operatingsystem_test.go (db model), following the one-test-file-per-type convention. No test logic changes.

Signed-off-by: Patrice Breton <pbreton@nvidia.com>

coderabbitai · 2026-07-24T02:24:05Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 431a7496-6178-43c2-880f-e74d4f31c133

📥 Commits

Reviewing files that changed from the base of the PR and between d0425e8 and cc6d9a0.

📒 Files selected for processing (6)

rest-api/api/pkg/api/handler/operatingsystem.go
rest-api/api/pkg/api/handler/operatingsystem_templated_proxy_test.go
rest-api/api/pkg/api/model/operatingsystem.go
rest-api/api/pkg/api/model/operatingsystem_templated_test.go
rest-api/workflow/pkg/activity/operatingsystem/operatingsystem.go
rest-api/workflow/pkg/activity/operatingsystem/operatingsystem_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

rest-api/api/pkg/api/handler/operatingsystem.go

Summary by CodeRabbit

New Features
- Added role-based ownership and visibility for operating systems.
- Provider administrators see provider-owned systems; tenant administrators see tenant-owned systems plus provider systems available at accessible sites.
- Added ownership-aware create, update, delete, and read permissions.
- Tenant administrators can create all supported system types, while provider administrators can create only templated iPXE systems.
- Added owner-scoped name uniqueness and site-access validation.
Documentation
- Updated API guidance to reflect the new authorization and visibility rules.
Bug Fixes
- Provider-owned creations no longer include tenant organization details.

Walkthrough

Operating System handlers now derive authorization from provider and tenant roles, persist provider- or tenant-owned records, enforce site-scoped visibility, and authorize updates and deletes by ownership. DAO filters, request mapping, tests, workflow comments, and OpenAPI descriptions reflect the new behavior.

Changes

Operating System access control

Layer / File(s)	Summary
Create ownership and site validation `rest-api/api/pkg/api/handler/operatingsystem.go`, `rest-api/api/pkg/api/model/operatingsystem.go`, `rest-api/api/pkg/api/handler/operatingsystem_templated_proxy_test.go`, `rest-api/api/pkg/api/model/operatingsystem_templated_test.go`, `rest-api/api/pkg/api/handler/operatingsystem_test.go`, `rest-api/openapi/spec.yaml`	Creation derives provider or tenant ownership from caller roles, restricts provider admins to templated iPXE systems, validates owner-scoped names and target sites, persists the selected owner, and omits tenant organization data for provider-owned records.
Listing visibility and DAO filtering `rest-api/api/pkg/api/handler/operatingsystem.go`, `rest-api/db/pkg/db/model/operatingsystem.go`, `rest-api/api/pkg/api/handler/operatingsystem_test.go`, `rest-api/db/pkg/db/model/operatingsystem_test.go`, `rest-api/openapi/spec.yaml`	Listing supports provider-only, tenant-only, and dual-role visibility; tenant-admin provider records require associations with accessible sites.
Single-resource visibility `rest-api/api/pkg/api/handler/operatingsystem.go`, `rest-api/api/pkg/api/handler/operatingsystem_test.go`, `rest-api/openapi/spec.yaml`	Single-record reads authorize matching ownership and permit tenant-admin access to provider-owned systems associated with accessible sites.
Update and delete ownership enforcement `rest-api/api/pkg/api/handler/operatingsystem.go`, `rest-api/api/pkg/api/handler/operatingsystem_test.go`	Updates and deletes authorize tenant or provider ownership, scope update name checks by owner, and condition instance checks on tenant context.
Workflow ownership documentation `rest-api/workflow/pkg/activity/operatingsystem/operatingsystem.go`, `rest-api/workflow/pkg/activity/operatingsystem/operatingsystem_test.go`	Workflow comments describe provider- and tenant-owned reconciliation records and ownership attribution.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant OperatingSystemHandler
  participant TenantSite
  participant OperatingSystemSQLDAO
  Caller->>OperatingSystemHandler: request Operating System access
  OperatingSystemHandler->>TenantSite: resolve tenant-accessible sites
  OperatingSystemHandler->>OperatingSystemSQLDAO: apply ownership and site visibility filters
  OperatingSystemSQLDAO-->>OperatingSystemHandler: return authorized Operating Systems
  OperatingSystemHandler-->>Caller: response or forbidden status

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately captures the main change: provider capabilities for templated iPXE OS and tenant visibility.
Description check	✅ Passed	The description is directly related to the changeset and correctly summarizes the provider and tenant visibility work.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

copy-pr-bot · 2026-07-24T02:24:16Z

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

pbreton · 2026-07-24T02:24:28Z

@coderabbitai full review

coderabbitai · 2026-07-24T02:24:33Z

✅ Action performed

Full review finished.

github-actions · 2026-07-24T02:25:10Z

🌿 Preview your docs: https://nvidia-preview-pull-request-4067.docs.buildwithfern.com/infra-controller

github-actions · 2026-07-24T02:27:01Z

🔐 TruffleHog Secret Scan

✅ No secrets or credentials found!

Your code has been scanned for 700+ types of secrets and credentials. All clear! 🎉

🔗 View scan details

_{🕐 Last updated: 2026-07-24 02:27:00 UTC | Commit: d0425e8}

Send tenant_organization_id only for tenant-owned Operating Systems so provider-owned definitions remain provider-owned when synchronized to Core. Clarify reconciliation ownership and cover both request variants.

pbreton added 5 commits July 23, 2026 14:07

generate docs and sdk

d0425e8

Signed-off-by: Patrice Breton <pbreton@nvidia.com>

pbreton requested a review from a team as a code owner July 24, 2026 02:23

pbreton marked this pull request as draft July 24, 2026 02:24

rest-api: preserve OS ownership in Core create requests

cc6d9a0

Send tenant_organization_id only for tenant-owned Operating Systems so provider-owned definitions remain provider-owned when synchronized to Core. Clarify reconciliation ownership and cover both request variants.

pbreton marked this pull request as ready for review July 25, 2026 01:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(rest-api): add Provider-related capabilities to templated iPXE OS and make visible to tenants#4067

feat(rest-api): add Provider-related capabilities to templated iPXE OS and make visible to tenants#4067
pbreton wants to merge 6 commits into
NVIDIA:mainfrom
pbreton:feat/ipxe-templated-os-4

pbreton commented Jul 24, 2026

Uh oh!

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

copy-pr-bot Bot commented Jul 24, 2026

Uh oh!

pbreton commented Jul 24, 2026

Uh oh!

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 24, 2026

Uh oh!

github-actions Bot commented Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

pbreton commented Jul 24, 2026

Related issues

Type of Change

Breaking Changes

Testing

Uh oh!

coderabbitai Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

copy-pr-bot Bot commented Jul 24, 2026

Uh oh!

pbreton commented Jul 24, 2026

Uh oh!

coderabbitai Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 24, 2026

Uh oh!

github-actions Bot commented Jul 24, 2026

🔐 TruffleHog Secret Scan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading