[ZCF-4419] Add SCIM source tracking contract#4338
Conversation
|
Warning Review limit reached
More reviews will be available in 51 minutes and 50 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (29)
Warning
|
| Layer / File(s) | Summary |
|---|---|
持久化模型与常量 conf/db/upgrade/V5.5.28__schema.sql, header/src/main/java/org/zstack/header/resource/ResourceSourceConstant.java, header/src/main/java/org/zstack/header/resource/ResourceSourceRefVO.java |
新增资源来源引用表、实体映射、生命周期回调和资源来源常量。 |
资源来源查询接口 header/src/main/java/org/zstack/header/resource/ResourceSourceRefInventory.java, header/src/main/java/org/zstack/header/resource/ResourceSourceRefInventoryDoc_zh_cn.groovy, header/src/main/java/org/zstack/header/resource/APIQueryResourceSourceRef*.java, header/src/main/java/org/zstack/header/resource/APIQueryResourceSourceRef*Doc_zh_cn.groovy, header/src/main/java/org/zstack/header/resource/RBACInfo.java |
新增资源来源引用库存、查询 API、RBAC 描述和中文文档。 |
角色来源展开 header/src/main/java/org/zstack/header/identity/role/RoleType.java, header/src/main/java/org/zstack/header/identity/role/RoleVO.java, header/src/main/java/org/zstack/header/identity/role/RoleInventory.java |
RoleVO 关联资源来源引用，RoleInventory 公开并填充来源字段，RoleType 增加 None。 |
SCIM 接收端控制 core/src/main/java/org/zstack/core/scim/ScimGlobalConfig.java, core/src/main/java/org/zstack/core/scim/ScimService.java, header/src/main/java/org/zstack/header/scim/ScimResourceHandler.java |
新增 receiver.enabled 全局配置，ScimService 在初始化、清理和 apply() 校验中使用该配置，并通过 ScimResourceHandler 清理资源。 |
SCIM 角色变更拦截 identity/src/main/java/org/zstack/identity/rbac/RBACApiInterceptor.java |
RBACApiInterceptor 对 SCIM 管理角色的本地修改请求进行计数检查并阻断。 |
Sequence Diagram(s)
sequenceDiagram
participant ScimService
participant ThreadFacade
participant ScimResourceHandler
participant ReceiverEnabled as "ScimGlobalConfig.RECEIVER_ENABLED"
ScimService->>ReceiverEnabled: register update extension
ReceiverEnabled-->>ScimService: disabled update callback
ScimService->>ThreadFacade: submit cleanupWhenDisabled
ThreadFacade-->>ScimService: run cleanupScimResourcesIfPresent
ScimService->>ScimResourceHandler: cleanupResources("SCIM")
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~60 minutes
Poem
૮(ᵔᴥᵔ)ა 我蹦进资源源头里，
嗅到 SCIM 的小开关；
角色有了来处，引用有了名，
兔耳一抖，查询就亮堂；
啦啦，胡萝卜般清脆的同步光芒 ✨
Important
Pre-merge checks failed
Please resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error, 1 warning)
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Title check | ❌ Error | 标题与变更相关，但未遵循要求的 <type>[scope]: <description> 格式。 |
改为例如 feat[scim]: Add SCIM source tracking contract 这类格式，并保持 72 字符以内。 |
| Docstring Coverage | Docstring coverage is 1.09% which is insufficient. The required threshold is 80.00%. | Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (3 passed)
| Check name | Status | Explanation |
|---|---|---|
| Description check | ✅ Passed | 描述与本次 SCIM 源追踪、配置开关和清理联动改动一致。 |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Create PR with unit tests
- Commit unit tests in branch
sync/hanyu.liang/zcf-4419@@2
Comment @coderabbitai help to get the list of available commands.
|
Comment from yaohua.wu: Review: MR !10299 — ZCF-4419背景：为 Cloud 侧 SCIM receiver 增加通用来源标记（ 🟡 Warning 1 —
|
| 严重级别 | 数量 | 说明 |
|---|---|---|
| 🔴 Critical | 0 | — |
| 🟡 Warning | 3 | init() 初始化入口缺失确认、无锁快速路径线程安全、清理锁持有说明 |
| 🟢 Suggestion | 3 | 硬编码类名、多来源注释、VO 设计说明 |
整体评价：设计思路清晰，通用 ResourceSourceRefVO 契约和 ReentrantReadWriteLock 用于请求/清理同步的方案合理。最重要的待确认项是 ScimService.init() 是否有 Spring 初始化入口（Warning 1），这直接影响启动补偿和 extension 注册是否生效。
🤖 Robot Reviewer
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@header/src/main/java/org/zstack/header/resource/APIQueryResourceSourceRefMsgDoc_zh_cn.groovy`:
- Around line 11-23: The request-level documentation strings in
APIQueryResourceSourceRefMsgDoc_zh_cn.groovy are still written in Chinese, which
violates the repository’s English-only docstring requirement. Update the
top-level desc in this document and the query description inside rest.request
for APIQueryResourceSourceRefMsg to clear English wording, keeping the meaning
intact and consistent with the surrounding API docs.
In
`@header/src/main/java/org/zstack/header/resource/APIQueryResourceSourceRefReplyDoc_zh_cn.groovy`:
- Around line 10-31: The reply document text in
APIQueryResourceSourceRefReplyDoc_zh_cn.groovy still uses Chinese descriptions
for inventories, success, and error; update these doc entries to English only.
Edit the existing ref/field blocks for inventories, success, and error so their
desc strings are clear English equivalents, while keeping the same symbols and
schema fields unchanged.
In
`@header/src/main/java/org/zstack/header/resource/ResourceSourceRefInventoryDoc_zh_cn.groovy`:
- Around line 7-68: The documentation strings in
ResourceSourceRefInventoryDoc_zh_cn.groovy are still written in Chinese, which
conflicts with the repository text convention. Update the title and every field
desc in this doc generator to clear, correct English while keeping the same
meaning and matching the existing symbols like title and field blocks for uuid,
resourceUuid, resourceType, sourceType, sourceName, externalUuid, externalType,
syncType, createDate, and lastOpDate.
In `@identity/src/main/java/org/zstack/identity/rbac/RBACApiInterceptor.java`:
- Around line 57-73: Before running the SCIM reference check in
RBACApiInterceptor, normalize the roleUuid taken from RoleMessage by trimming
whitespace (and handling empty-after-trim as null/skip) so copied values with
spaces or newlines still match ResourceSourceRefVO correctly. Update the
existing roleUuid guard and the SQL.New lookup block together, keeping the
interception logic intact and ensuring the comparison uses the normalized value
before throwing ApiMessageInterceptionException.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: http://open.zstack.ai:20001/code-reviews/zstack-cloud.yaml (via .coderabbit.yaml)
Review profile: CHILL
Plan: Pro
Run ID: 3e4a1543-d8c1-4e42-b92f-2224599c4b80
⛔ Files ignored due to path filters (14)
conf/persistence.xmlis excluded by!**/*.xmlconf/serviceConfig/rbac.xmlis excluded by!**/*.xmlsdk/src/main/java/SourceClassMap.javais excluded by!sdk/**sdk/src/main/java/org/zstack/sdk/QueryResourceSourceRefAction.javais excluded by!sdk/**sdk/src/main/java/org/zstack/sdk/QueryResourceSourceRefResult.javais excluded by!sdk/**sdk/src/main/java/org/zstack/sdk/ResourceSourceRefInventory.javais excluded by!sdk/**sdk/src/main/java/org/zstack/sdk/iam2/api/ConfigureIAM2ScimReceiverAction.javais excluded by!sdk/**sdk/src/main/java/org/zstack/sdk/iam2/api/ConfigureIAM2ScimReceiverResult.javais excluded by!sdk/**sdk/src/main/java/org/zstack/sdk/iam2/entity/IAM2OrganizationInventory.javais excluded by!sdk/**sdk/src/main/java/org/zstack/sdk/iam2/entity/IAM2ProjectInventory.javais excluded by!sdk/**sdk/src/main/java/org/zstack/sdk/iam2/entity/IAM2VirtualIDGroupInventory.javais excluded by!sdk/**sdk/src/main/java/org/zstack/sdk/iam2/entity/IAM2VirtualIDInventory.javais excluded by!sdk/**sdk/src/main/java/org/zstack/sdk/identity/role/RoleInventory.javais excluded by!sdk/**sdk/src/main/java/org/zstack/sdk/identity/role/RoleType.javais excluded by!sdk/**
📒 Files selected for processing (17)
conf/db/upgrade/V5.5.28__schema.sqlcore/src/main/java/org/zstack/core/scim/ScimGlobalConfig.javacore/src/main/java/org/zstack/core/scim/ScimService.javaheader/src/main/java/org/zstack/header/identity/role/RoleInventory.javaheader/src/main/java/org/zstack/header/identity/role/RoleType.javaheader/src/main/java/org/zstack/header/identity/role/RoleVO.javaheader/src/main/java/org/zstack/header/resource/APIQueryResourceSourceRefMsg.javaheader/src/main/java/org/zstack/header/resource/APIQueryResourceSourceRefMsgDoc_zh_cn.groovyheader/src/main/java/org/zstack/header/resource/APIQueryResourceSourceRefReply.javaheader/src/main/java/org/zstack/header/resource/APIQueryResourceSourceRefReplyDoc_zh_cn.groovyheader/src/main/java/org/zstack/header/resource/RBACInfo.javaheader/src/main/java/org/zstack/header/resource/ResourceSourceConstant.javaheader/src/main/java/org/zstack/header/resource/ResourceSourceRefInventory.javaheader/src/main/java/org/zstack/header/resource/ResourceSourceRefInventoryDoc_zh_cn.groovyheader/src/main/java/org/zstack/header/resource/ResourceSourceRefVO.javaheader/src/main/java/org/zstack/header/scim/ScimResourceHandler.javaidentity/src/main/java/org/zstack/identity/rbac/RBACApiInterceptor.java
| desc """查询资源来源引用，用于识别资源是否由 ZIAM SCIM 等外部身份源同步管理。""" | ||
|
|
||
| rest { | ||
| request { | ||
| url "GET /v1/resources/source-refs" | ||
|
|
||
| header (Authorization: 'OAuth the-session-uuid') | ||
|
|
||
| clz APIQueryResourceSourceRefMsg.class | ||
|
|
||
| desc """按资源UUID、资源类型、来源类型或同步类型查询资源来源引用。""" | ||
|
|
||
| params APIQueryMessage.class |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
请把接口文档描述改成英文。
当前请求级 desc 和查询说明都是中文，不符合仓库对代码与文档字符串的统一英文要求。As per path instructions, "**/*.*: - 代码里不应当有有中文，包括报错、注释等都应当使用正确的、无拼写错误的英文来写".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@header/src/main/java/org/zstack/header/resource/APIQueryResourceSourceRefMsgDoc_zh_cn.groovy`
around lines 11 - 23, The request-level documentation strings in
APIQueryResourceSourceRefMsgDoc_zh_cn.groovy are still written in Chinese, which
violates the repository’s English-only docstring requirement. Update the
top-level desc in this document and the query description inside rest.request
for APIQueryResourceSourceRefMsg to clear English wording, keeping the meaning
intact and consistent with the surrounding API docs.
Source: Path instructions
| ref { | ||
| name "inventories" | ||
| path "org.zstack.header.resource.APIQueryResourceSourceRefReply.inventories" | ||
| desc "资源来源引用清单" | ||
| type "List" | ||
| since "5.5.28" | ||
| clz ResourceSourceRefInventory.class | ||
| } | ||
| field { | ||
| name "success" | ||
| desc "API调用是否成功" | ||
| type "boolean" | ||
| since "5.5.28" | ||
| } | ||
| ref { | ||
| name "error" | ||
| path "org.zstack.header.resource.APIQueryResourceSourceRefReply.error" | ||
| desc "错误码，若不为null，则表示操作失败, 操作成功时该字段为null",false | ||
| type "ErrorCode" | ||
| since "5.5.28" | ||
| clz ErrorCode.class | ||
| } |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
请将返回体文档里的中文说明替换为英文。
inventories、success、error 的说明文本现在都是中文，这会直接违反仓库的全局文本规范。As per path instructions, "**/*.*: - 代码里不应当有有中文，包括报错、注释等都应当使用正确的、无拼写错误的英文来写".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@header/src/main/java/org/zstack/header/resource/APIQueryResourceSourceRefReplyDoc_zh_cn.groovy`
around lines 10 - 31, The reply document text in
APIQueryResourceSourceRefReplyDoc_zh_cn.groovy still uses Chinese descriptions
for inventories, success, and error; update these doc entries to English only.
Edit the existing ref/field blocks for inventories, success, and error so their
desc strings are clear English equivalents, while keeping the same symbols and
schema fields unchanged.
Source: Path instructions
| title "资源来源引用" | ||
|
|
||
| field { | ||
| name "uuid" | ||
| desc "引用记录UUID" | ||
| type "String" | ||
| since "5.5.28" | ||
| } | ||
| field { | ||
| name "resourceUuid" | ||
| desc "资源UUID" | ||
| type "String" | ||
| since "5.5.28" | ||
| } | ||
| field { | ||
| name "resourceType" | ||
| desc "Cloud 侧资源类型，例如 IAM2VirtualIDVO、IAM2VirtualIDGroupVO、IAM2OrganizationVO、IAM2ProjectVO" | ||
| type "String" | ||
| since "5.5.28" | ||
| } | ||
| field { | ||
| name "sourceType" | ||
| desc "资源来源类型，ZIAM SCIM 同步资源固定为 ZIAM" | ||
| type "String" | ||
| since "5.5.28" | ||
| } | ||
| field { | ||
| name "sourceName" | ||
| desc "资源来源名称，ZIAM SCIM 同步资源固定为 ziam" | ||
| type "String" | ||
| since "5.5.28" | ||
| } | ||
| field { | ||
| name "externalUuid" | ||
| desc "上游身份源中的资源UUID" | ||
| type "String" | ||
| since "5.5.28" | ||
| } | ||
| field { | ||
| name "externalType" | ||
| desc "上游身份源中的资源类型" | ||
| type "String" | ||
| since "5.5.28" | ||
| } | ||
| field { | ||
| name "syncType" | ||
| desc "同步类型，SCIM 同步资源固定为 SCIM" | ||
| type "String" | ||
| since "5.5.28" | ||
| } | ||
| field { | ||
| name "createDate" | ||
| desc "创建时间" | ||
| type "Timestamp" | ||
| since "5.5.28" | ||
| } | ||
| field { | ||
| name "lastOpDate" | ||
| desc "最后一次修改时间" | ||
| type "Timestamp" | ||
| since "5.5.28" | ||
| } |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
请将文档字符串统一改成英文。
这里的 title 和各个 desc 都是中文，和仓库的全局文本规范冲突，生成出来的文档也会因此出现不符合约束的内容。As per path instructions, "**/*.*: - 代码里不应当有有中文，包括报错、注释等都应当使用正确的、无拼写错误的英文来写".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@header/src/main/java/org/zstack/header/resource/ResourceSourceRefInventoryDoc_zh_cn.groovy`
around lines 7 - 68, The documentation strings in
ResourceSourceRefInventoryDoc_zh_cn.groovy are still written in Chinese, which
conflicts with the repository text convention. Update the title and every field
desc in this doc generator to clear, correct English while keeping the same
meaning and matching the existing symbols like title and field blocks for uuid,
resourceUuid, resourceType, sourceType, sourceName, externalUuid, externalType,
syncType, createDate, and lastOpDate.
Source: Path instructions
MatheMatrix
force-pushed
the
sync/hanyu.liang/zcf-4419@@2
branch
3 times, most recently
from
6387996 to
f26017d
Compare
Merge the Cloud side of ZCF-4419 into one reviewable source tracking change. Add ResourceSourceRefVO schema/persistence, source constants, query API, RBAC contribution, inventory docs, and SDK classes for resources synchronized from external identity sources. Expose SCIM source fields on IAM2 and role inventories, keep role source refs lazy, and avoid brittle RoleVO simple-name filtering when applying source information. Add scim.receiver.enabled and receiver-disable cleanup through ScimResourceHandler.cleanupResources. Startup cleanup is compensated when the receiver is already disabled, cleanup and SCIM request handling are synchronized with a read/write lock, and GlobalConfig extension registration can self-heal after test/global-config re-linking. Tighten ResourceSourceRefVO persistence semantics with non-null source key columns, non-null uuid mapping, and create/update timestamp initialization. Verification: git diff --check ./runMavenProfile premium mvn -pl iam2,plugin-premium/iam2-script-plugin,test-premium -Djacoco.skip=true -Dtest=IAM2Test -DsubCaseCollectionStrategy=Designated -DcaseFilePath=/tmp/iam2_failed_cases.txt -DfailIfNoTests=false test mvn -pl plugin-premium/sso-plugin -Dtest=IAM2RopcLoginBackendTest test Resolves: ZCF-4419 Change-Id: Ibce13e7b792a16ba01f9c404ae46e2c1a83a1865
MatheMatrix
force-pushed
the
sync/hanyu.liang/zcf-4419@@2
branch
from
f26017d to
28e3500
Compare
3 participants
Summary
ResourceSourceRefVOcontract for resources synced from external identity sources.scim.receiver.enabledGlobalConfig and reject SCIM requests while disabled.Verification
cd header && mvn clean install -Dmaven.test.skip=truecd core && mvn clean install -Dmaven.test.skip=truecd identity && mvn clean install -Dmaven.test.skip=truecd premium/test-premium && mvn test -Djacoco.skip=true -Dtest=IAM2ScimReceiverCasegit diff --checkResolves: ZCF-4419
sync from gitlab !10299