Skip to content

refactor: move SearchOrganizationInvoices to FrontierService#1549

Merged
paanSinghCoder merged 3 commits intomainfrom
refactor/search-org-invoices-to-frontier-service
Apr 20, 2026
Merged

refactor: move SearchOrganizationInvoices to FrontierService#1549
paanSinghCoder merged 3 commits intomainfrom
refactor/search-org-invoices-to-frontier-service

Conversation

@paanSinghCoder
Copy link
Copy Markdown
Contributor

@paanSinghCoder paanSinghCoder commented Apr 17, 2026 •
edited
Loading

Merge Proton PR-476 first

Summary

  • Move `SearchOrganizationInvoices` RPC from `AdminService` → `FrontierService` so org admins (not only platform superusers) can list their own org's invoices.
  • Bump `PROTON_COMMIT` to pick up the proto move from refactor(frontier): move SearchOrganizationInvoices to FrontierService proton#476.
  • `authorization.go`: `IsSuperUser` → `IsAuthorized(org, UpdatePermission)` (matches the gate on `FrontierService/ListInvoices`). Superusers still pass via the standard interceptor bypass.
  • Regenerated `proto/v1beta1` via `make proto`.
  • Admin dashboard: swapped `AdminServiceQueries.searchOrganizationInvoices` → `FrontierServiceQueries.searchOrganizationInvoices`. Request/response shape is unchanged, so no other UI edits needed.

Dependency

Depends on raystack/proton#476 merging so the new `@raystack/proton` prerelease gets auto-published to npm. After that PR merges, `web/sdk/package.json` needs its `@raystack/proton` pin bumped to the new `0.1.0-` version before the TS build will pass.

Test plan

  • `go build ./...` passes locally
  • CI go tests green
  • After proton#476 merges + npm publish + sdk version bump: `make admin-app` passes
  • Smoke test: call `/raystack.frontier.v1beta1.FrontierService/SearchOrganizationInvoices` as (a) an org admin, (b) a superuser, (c) an unrelated user — expect success, success, PermissionDenied

🤖 Generated with Claude Code

@paanSinghCoder @claude
refactor: move SearchOrganizationInvoices to FrontierService
15065a8 
Move the RPC from AdminService to FrontierService so org admins (not only
platform superusers) can list their own org's invoices. Matches the gate
pattern already used by FrontierService/ListInvoices (UpdatePermission on
the org namespace). Superusers still pass via the standard interceptor
bypass.

- Bump PROTON_COMMIT to pick up the proto move (raystack/proton#476).
- Regenerate proto/v1beta1 via `make proto`.
- Swap authorization.go entry from IsSuperUser to IsAuthorized(org, UpdatePermission).
- Switch the admin dashboard frontend from AdminServiceQueries to
  FrontierServiceQueries; request/response shape is unchanged.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@vercel
Copy link
Copy Markdown

vercel bot commented Apr 17, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
frontier Error Error Apr 20, 2026 7:25am

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Apr 17, 2026 •
edited
Loading

Warning

Rate limit exceeded

@paanSinghCoder has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 46 minutes and 7 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 46 minutes and 7 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 096955ac-c578-4eab-8d0c-cb302842abc9

📥 Commits

Reviewing files that changed from the base of the PR and between 6e2b85e and 0755a73.

⛔ Files ignored due to path filters (1)
  • web/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (2)
  • web/apps/admin/package.json
  • web/sdk/package.json
📝 Walkthrough

Walkthrough

The pull request updates the Proton commit reference in the Makefile and migrates the SearchOrganizationInvoices endpoint from AdminService to FrontierService, changing authorization enforcement from superuser checks to organization-scoped permissions. The frontend is updated to use the new query reference accordingly.

Changes

Cohort / File(s) Summary
Proton Version Bump
Makefile		 Updated PROTON_COMMIT variable to reference a new Proton commit hash for proto generation.
Authorization Rule Migration
pkg/server/connect_interceptors/authorization.go		 Moved SearchOrganizationInvoices from AdminService (superuser-gated) to FrontierService (organization-scoped authorization with update permission).
Frontend Query Update
web/sdk/admin/views/organizations/details/invoices/index.tsx		 Switched query import from AdminServiceQueries.searchOrganizationInvoices to FrontierServiceQueries.searchOrganizationInvoices.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

Suggested reviewers

  • rsbh
  • rohanchkrabrty

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coveralls
Copy link
Copy Markdown

coveralls commented Apr 17, 2026 •
edited
Loading

Coverage Report for CI Build 24653828616

Coverage decreased (-0.001%) to 42.07%

Details

  • Coverage decreased (-0.001%) from the base build.
  • Patch coverage: 4 uncovered changes across 1 file (0 of 4 lines covered, 0.0%).
  • No coverage regressions found.

Uncovered Changes

File Changed Covered %
pkg/server/connect_interceptors/authorization.go 4 0 0.0%

Coverage Regressions

No coverage regressions found.

Coverage Stats

Coverage Status
Relevant Lines: 36962
Covered Lines: 15550
Line Coverage: 42.07%
Coverage Strength: 11.84 hits per line
💛 - Coveralls

@paanSinghCoder paanSinghCoder self-assigned this Apr 20, 2026
@paanSinghCoder paanSinghCoder added the Do not merge Label to indicate that the PR is not ready to be merged even though might be (or not) approvals. label Apr 20, 2026
@paanSinghCoder paanSinghCoder mentioned this pull request Apr 20, 2026
Open
5 tasks
@paanSinghCoder paanSinghCoder mentioned this pull request Apr 20, 2026
Merged
2 tasks
coderabbitai[bot]
coderabbitai bot reviewed Apr 20, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
pkg/server/connect_interceptors/authorization.go (1)

998-1001: The authorization mapping is correct, but add test coverage for the org-scoped invoice gate.

The code correctly uses GetId() for SearchOrganizationInvoicesRequest (the Id field contains the org ID) and GetOrgId() for ListInvoicesRequest. Both routes properly enforce UpdatePermission on the organization. However, no tests were found covering this authorization rule—consider adding unit or integration tests for org-admin allowed and non-authorized user denied scenarios.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 28e2fe83-8877-4216-bd1f-79713a100a45

📥 Commits

Reviewing files that changed from the base of the PR and between f09c377 and 6e2b85e.

⛔ Files ignored due to path filters (4)
  • proto/v1beta1/admin.pb.go is excluded by !**/*.pb.go, !proto/**
  • proto/v1beta1/frontier.pb.go is excluded by !**/*.pb.go, !proto/**
  • proto/v1beta1/frontierv1beta1connect/admin.connect.go is excluded by !proto/**
  • proto/v1beta1/frontierv1beta1connect/frontier.connect.go is excluded by !proto/**
📒 Files selected for processing (3)
  • Makefile
  • pkg/server/connect_interceptors/authorization.go
  • web/sdk/admin/views/organizations/details/invoices/index.tsx

Comment thread web/sdk/admin/views/organizations/details/invoices/index.tsx
@paanSinghCoder
fix: update @raystack/proton version to 0.1.0-a34fad75e08453004b9a8c0…
0755a73 
…931e4ca9b087de8cd in package.json and pnpm-lock.yaml
@paanSinghCoder paanSinghCoder removed the Do not merge Label to indicate that the PR is not ready to be merged even though might be (or not) approvals. label Apr 20, 2026
@paanSinghCoder paanSinghCoder merged commit cd1a62d into main Apr 20, 2026
7 of 8 checks passed
@paanSinghCoder paanSinghCoder deleted the refactor/search-org-invoices-to-frontier-service branch April 20, 2026 08:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] left review comments

@AmanGIT07 AmanGIT07 AmanGIT07 approved these changes

@rsbh rsbh Awaiting requested review from rsbh

Assignees

@paanSinghCoder paanSinghCoder

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@paanSinghCoder @coveralls @AmanGIT07