Improvement to gateway controller's Management API flows

[DinithHerath]

Purpose

$subject

[coderabbitai]

Warning

Review limit reached

@DinithHerath, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 11 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8acfb4d8-28a9-4161-bb70-41ec42e85011

📥 Commits

Reviewing files that changed from the base of the PR and between 75ba721 and 7af5116.

📒 Files selected for processing (3)

• gateway/it/features/template-functions.feature
• gateway/it/steps/assert_steps.go
• gateway/it/steps_template.go

📝 Walkthrough

Walkthrough

Management subscription routes are now admin-only. Upstream credentials are write-only, inherited during updates when omitted, and redacted from materialized responses for LLM provider, LLM proxy, and MCP proxy configurations.

Changes

Credential protection and management authorization

Layer / File(s)	Summary
Management authorization and credential contract gateway/gateway-controller/api/management-openapi.yaml, gateway/gateway-controller/cmd/controller/main.go, gateway/gateway-controller/pkg/api/management/generated.go	Subscription and subscription-plan routes allow only admin; upstream auth values are documented as write-only with omission and explicit-removal semantics, and the embedded Swagger specification is regenerated.
Credential inheritance during updates gateway/gateway-controller/pkg/utils/credential_inheritance.go, gateway/gateway-controller/pkg/utils/*_deployment.go, gateway/gateway-controller/pkg/utils/credential_inheritance_test.go	Update processing loads stored configurations and inherits credentials for LLM providers, LLM proxies, and MCP proxies, including additional-provider ID matching, credential rotation, auth-type changes, and explicit removal.
Credential redaction in management responses gateway/gateway-controller/pkg/api/handlers/credential_redaction.go, gateway/gateway-controller/pkg/api/handlers/*_handler.go, gateway/gateway-controller/pkg/api/handlers/handlers.go, gateway/gateway-controller/pkg/api/handlers/credential_redaction_test.go, gateway/it/features/template-functions.feature, gateway/it/steps/assert_steps.go	Materialization and deployment search paths clear upstream auth values, including nested LLM proxy providers, while preserving auth blocks and non-credential fields. Unit and integration tests verify redaction, secret references, omitted JSON fields, nil auth blocks, and non-credential configurations.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

Update credential inheritance

sequenceDiagram
  participant ManagementAPI
  participant DeploymentPipeline
  participant storedSourceForUpdate
  participant CredentialInheritance
  ManagementAPI->>DeploymentPipeline: parse update configuration
  DeploymentPipeline->>storedSourceForUpdate: load persisted SourceConfiguration
  storedSourceForUpdate-->>DeploymentPipeline: stored configuration
  DeploymentPipeline->>CredentialInheritance: inherit missing credentials
  CredentialInheritance-->>DeploymentPipeline: updated configuration
  DeploymentPipeline->>DeploymentPipeline: render and validate

Loading

Management response redaction

sequenceDiagram
  participant SearchDeployments
  participant buildDeploymentListItem
  participant rematerializeConfig
  participant ManagementResponse
  SearchDeployments->>buildDeploymentListItem: build deployment item
  buildDeploymentListItem->>rematerializeConfig: rematerialize stored configuration
  rematerializeConfig->>rematerializeConfig: clear upstream auth values
  rematerializeConfig-->>buildDeploymentListItem: redacted configuration
  buildDeploymentListItem-->>ManagementResponse: resource response without credential values

Loading

Possibly related PRs

• wso2/api-platform#2797: Related secret-management integration scenarios validate write-only upstream secret handling.
• wso2/api-platform#2919: Both changes restrict selected management API Basic Auth routes to the admin role in the OpenAPI and generated authorization configuration.

Suggested reviewers: pubudu538, malinthaprasan, lasanthas, tgtshanika, tharindu1st

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description only includes a stub Purpose section and misses the required template sections.	Fill in Goals, Approach, User stories, Documentation, Automation tests, Security checks, Samples, Related PRs, and Test environment.
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title is related to the PR but too generic to convey the main change.	Use a concise, specific title that names the main Management API change, such as credential redaction or access-role tightening.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted.

Error details

putComment timed out

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@gateway/gateway-controller/pkg/api/handlers/handlers.go`:
- Around line 285-293: Update the buildDeploymentListItem error handling in
SearchDeployments to log the malformed configuration and continue iterating,
rather than writing a 500 response and returning. Preserve the existing
continue-on-error behavior used for context-filter failures, and append only
successfully built items.

In `@gateway/gateway-controller/pkg/utils/credential_inheritance.go`:
- Around line 136-157: The credential inheritance helpers inherit stored values
even when the incoming authentication type changes. Update
inheritLLMProviderCredential, inheritLLMUpstreamAuth, and
inheritMCPProxyCredential so stored credentials are reused only when
incoming.Type matches stored.Type; preserve explicit "none" removal and avoid
inheriting values for changed or unsupported auth types.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 89cc6a85-6387-4095-a20c-2953a5c9292b

📥 Commits

Reviewing files that changed from the base of the PR and between e5916fa and 2955dd4.

📒 Files selected for processing (13)

• gateway/gateway-controller/api/management-openapi.yaml
• gateway/gateway-controller/cmd/controller/main.go
• gateway/gateway-controller/pkg/api/handlers/credential_redaction.go
• gateway/gateway-controller/pkg/api/handlers/credential_redaction_test.go
• gateway/gateway-controller/pkg/api/handlers/handlers.go
• gateway/gateway-controller/pkg/api/handlers/llm_provider_handler.go
• gateway/gateway-controller/pkg/api/handlers/llm_proxy_handler.go
• gateway/gateway-controller/pkg/api/handlers/mcp_proxy_handler.go
• gateway/gateway-controller/pkg/api/management/generated.go
• gateway/gateway-controller/pkg/utils/credential_inheritance.go
• gateway/gateway-controller/pkg/utils/credential_inheritance_test.go
• gateway/gateway-controller/pkg/utils/llm_deployment.go
• gateway/gateway-controller/pkg/utils/mcp_deployment.go

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@gateway/it/features/template-functions.feature`:
- Line 189: Update the database assertion in the “secret template in LlmProvider
upstream auth value” scenario to verify that the resolved secret value
“llm-prov-secret-789” is absent from the persisted configuration, while
retaining the check that the template remains stored.

In `@gateway/it/steps/assert_steps.go`:
- Around line 201-208: Update jsonFieldShouldNotExist to treat only the
dedicated missing-field/not-found error from getJSONField as success; propagate
malformed JSON, invalid-index, type-mismatch, and other errors unchanged, while
retaining the existing failure for a present field.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 196e1473-be9b-4ef1-a60f-51c2c6aff8a0

📥 Commits

Reviewing files that changed from the base of the PR and between 0b1821b and 75ba721.

📒 Files selected for processing (2)

• gateway/it/features/template-functions.feature
• gateway/it/steps/assert_steps.go