Skip to content

DevEx Improvements - #8

Merged
AFAskar merged 21 commits into
devfrom
Feature/hotfix/deployment-and-devex
Feb 5, 2026
Merged

DevEx Improvements#8
AFAskar merged 21 commits into
devfrom
Feature/hotfix/deployment-and-devex

Conversation

@AFAskar

@AFAskar AFAskar commented Feb 5, 2026

Copy link
Copy Markdown
Owner

Summary by CodeRabbit

  • New Features

    • Added role-based access control (RBAC) with permissions for read, write, and delete operations
    • Implemented rerun capability for failed evaluations
    • Added delete functionality for submissions
    • Introduced domain-based file organization for evaluations
    • Added error alerts for insufficient permissions
  • Documentation

    • Added comprehensive demo setup guide with Keycloak SSO integration
    • Added RBAC configuration documentation
  • Infrastructure

    • Added Docker demo environment with Keycloak and multi-service orchestration
    • Optimized Docker image builds and configurations
  • Dependencies

    • Added Radix UI themes and WorkOS libraries for authentication and authorization

@coderabbitai

coderabbitai Bot commented Feb 5, 2026

Copy link
Copy Markdown

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Walkthrough

This PR introduces a comprehensive permission-based access control system using WorkOS, containerizes services with multi-stage Docker builds, refactors AI evaluation to domain-scoped models, and updates frontend routes with authentication guards. Changes span infrastructure, API backend, database schema, and frontend application.

Changes

Cohort / File(s) Summary
Docker Infrastructure
.dockerignore, ai.dockerfile, .github/workflows/publish.yml, docker-compose.demo.yml, docker-compose.dev.yml, docker-compose.yml
Added multi-stage AI Dockerfile with optimized virtual environment layering; introduced GitHub Actions workflow for building and publishing Docker images; created demo and updated dev compose files with health checks, environment configuration, and service dependencies.
Frontend Route Authentication
apps/tanstack-start/src/routes/__root.tsx, apps/tanstack-start/src/routes/admin/index.tsx, apps/tanstack-start/src/routes/admin/company.$companyId.tsx, apps/tanstack-start/src/routes/admin/ndi.tsx, apps/tanstack-start/src/routes/submit.tsx
Added beforeLoad guards enforcing authentication and read/write permissions across admin and submission routes; introduced evaluation rerun capability with mutation handling; extended route validation with error query parameters.
Frontend Permissions & Auth UI
apps/tanstack-start/src/lib/permissions.ts, apps/tanstack-start/src/component/layout/Header.tsx, apps/tanstack-start/src/routes/index.tsx
Created permissions utility library with hasPermission, hasAllPermissions, and hasAnyPermission helpers; added permission-aware admin dashboard link visibility in header; introduced insufficient-permissions error banner on home route.
Frontend Components & Config
apps/tanstack-start/src/component/NotFound.tsx, apps/tanstack-start/src/component/auth-showcase.tsx, apps/tanstack-start/src/component/index/IndexCard.tsx, apps/tanstack-start/src/env.ts, apps/tanstack-start/package.json, apps/tanstack-start/src/routes/api/auth/callback.tsx
Refactored component JSX structure and styling; reordered imports; added WorkOS and Radix UI theme dependencies; adjusted env configuration reference.
Backend RBAC System
packages/api/src/trpc.ts, packages/api/src/lib/workos.ts, packages/api/src/index.ts
Introduced WorkOS client initialization and SUBMISSION_PERMISSIONS constant; created createPermissionProcedure higher-order function enforcing permission checks; added permissions extraction to TRPC context.
Backend API Routes
packages/api/src/router/submission.ts
Replaced protectedProcedure with createPermissionProcedure for permission-based access; added delete and rerunEvaluation mutations; enhanced file persistence with content/type storage; integrated domain_ids propagation to AI service.
Database Schema
packages/db/src/schema/submissions.ts
Added fileContent (text) and fileType fields to SubmissionFile; extended EvaluationReport with status, completedAt, and createdAt timestamp fields.
AI Service Domain Refactoring
services/ai-service/src/agent/run.py, services/ai-service/src/api/routers/evaluations.py, services/ai-service/src/services/evaluation_service.py, services/ai-service/pyproject.toml, services/ai-service/run.py
Replaced per-file control_ids mechanism with domain_ids parameter; increased file limit from 20 to 120; updated submission payload to propagate domain_ids; added startup environment validation; removed torch and other dependencies from direct requirements.
API Client Code Generation
packages/api/src/ai-client/... (multiple files)
Standardized string literals from single to double quotes; reformatted type signatures and imports; updated BodySubmitEvaluationApiV1EvaluationsSubmitPost to use domain_ids field instead of control_ids_1–20; applied consistent formatting across generated SDK files.
Documentation
docs/DEMO_SETUP.md, docs/RBAC_SETUP.md
Added comprehensive setup guides for WorkOS Keycloak SSO demo integration and RBAC configuration, including realm setup, permission definitions, role mappings, and frontend/backend implementation examples.
Configuration & Utilities
packages/api/package.json, packages/validators/..., tooling/tailwind/theme.css, pnpm-workspace.yaml, .github/.copilot-instructions.md
Added @workos-inc/node dependency; updated copilot instructions for frontend framework guidance; normalized tsconfig formatting; minor style/whitespace adjustments across configuration files.

Sequence Diagram(s)

sequenceDiagram
    participant User as User/Browser
    participant Frontend as Frontend App
    participant Auth as Auth Service<br/>(WorkOS)
    participant Backend as Backend API
    participant DB as Database

    User->>Frontend: Navigate to /admin
    Frontend->>Backend: Check auth status
    Backend->>Auth: Verify session
    Auth-->>Backend: User + Permissions
    Backend-->>Frontend: {user, permissions}
    
    Frontend->>Frontend: Check hasPermission<br/>SUBMISSION_PERMISSIONS.READ
    
    alt Insufficient Permissions
        Frontend-->>User: Redirect with error
    else Has Permission
        Frontend->>Backend: Fetch submissions
        Backend->>DB: Query submissions
        DB-->>Backend: Submission list
        Backend-->>Frontend: Data + metadata
        Frontend-->>User: Render admin dashboard
    end
Loading
sequenceDiagram
    participant User as User/Browser
    participant Frontend as Frontend
    participant Backend as Backend API
    participant AI as AI Service
    participant DB as Database

    User->>Frontend: Click Rerun on failed<br/>evaluation
    Frontend->>Backend: rerunEvaluation mutation
    Backend->>DB: Get submission files<br/>(with stored content)
    DB-->>Backend: File records + content
    Backend->>Backend: Reconstruct file blobs<br/>from stored content
    Backend->>AI: POST /api/v1/evaluations/submit<br/>(files + domain_ids)
    AI->>AI: run_evaluation_agent
    AI-->>Backend: Evaluation results
    Backend->>DB: Store EvaluationReport
    Backend-->>Frontend: {success, report}
    Frontend-->>User: Show results +<br/>dismiss loading state
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~70 minutes

Possibly related PRs

  • Initialized the FrontEnd #6: Modifies .github/.copilot-instructions.md file with editorial guidance changes, directly overlapping with this PR's copilot instructions updates.
  • built- evaluation agent #4: Refactors AI service evaluation agent code (services/ai-service/src/agent/run.py, evaluation_service) with control_ids/domain_ids logic changes, directly overlapping with domain scoping refactor.
  • Feature/ai/rag & prompt extraction #2: Updates AI service and RAG extraction modules (services/ai-service: run.py, evaluation_service, api/routers) with overlapping domain-based and permission integration changes.

Poem

🐰 Hops excitedly
Permissions granted, domains in place,
Docker containers race through cyberspace,
Routes now guarded with auth's embrace,
Evaluations rerun without a trace,
Frontend shines with WorkOS's grace! 🐇

✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch Feature/hotfix/deployment-and-devex

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@AFAskar
AFAskar merged commit 341ab40 into dev Feb 5, 2026
1 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants