feat(api): identify active membership in current user response - #12388
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe ChangesTenant membership activity
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant APIClient
participant UserViewSet
participant UserMeSerializer
participant ActiveMembershipRelatedField
APIClient->>UserViewSet: Request the me action
UserViewSet->>UserViewSet: Resolve UserMeSerializer
UserViewSet->>UserMeSerializer: Serialize the current user
UserMeSerializer->>ActiveMembershipRelatedField: Serialize memberships
ActiveMembershipRelatedField-->>APIClient: Return memberships with meta.active
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ All required changelog fragments are present. |
|
✅ No Conflicts No conflict markers, and the branch merges cleanly into its base. |
There was a problem hiding this comment.
Pull request overview
This PR updates the API’s GET /api/v1/users/me response so API clients can reliably determine which membership corresponds to the active tenant in the current authentication context, by annotating each returned membership resource identifier with meta.active.
Changes:
- Introduces an action-specific
UserMeSerializerthat marks each membership relationship item withmeta.activebased onrequest.tenant_id. - Updates
UserViewSet.meto useself.get_serializer(...)and routes themeaction through the new serializer without affecting other user endpoints. - Extends the multi-tenant API key integration test to assert
meta.activetoggles correctly per tenant/API key.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| api/src/backend/api/v1/views.py | Selects an action-specific serializer for the me action and uses get_serializer() to ensure correct serializer/context usage. |
| api/src/backend/api/v1/serializers.py | Adds a relationship field that injects meta.active into membership resource identifiers and a UserMeSerializer to scope the behavior to /users/me. |
| api/src/backend/api/tests/integration/test_authentication.py | Updates the API key multi-tenant integration test to validate meta.active per membership for different tenant-bound API keys. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@api/src/backend/api/v1/serializers.py`:
- Around line 332-340: Update ActiveMembershipRelatedField.to_representation to
guard access to request.tenant_id before constructing representation["meta"];
when tenant context is absent, avoid raising AttributeError and preserve safe
relationship serialization, while retaining the existing active comparison when
tenant_id is available.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5b825231-ffcf-42f9-a3f7-3d2abb921756
📒 Files selected for processing (3)
api/src/backend/api/tests/integration/test_authentication.pyapi/src/backend/api/v1/serializers.pyapi/src/backend/api/v1/views.py
🔒 Container Security ScanImage: ✅ No Vulnerabilities DetectedThe container image passed all security checks. No known CVEs were found.📋 Resources:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #12388 +/- ##
=======================================
Coverage 94.55% 94.55%
=======================================
Files 271 271
Lines 42211 42224 +13
=======================================
+ Hits 39914 39927 +13
Misses 2297 2297
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
🔎 Container Security Scan (Grype)Image: ✅ Nothing BlockingNo findings at critical or high severity. Not blocking at this cutoff — medium: 20, low: 4, negligible: 1. 44 finding(s) excluded by 📋 Resources:
|
Context
The active tenant is part of the authentication context, but
GET /api/v1/users/mereturned all membership identifiers without indicating which membership matched that tenant. API clients, especially those using API keys, could not determine the active membership from the response.Description
meta.activeto each membership resource identifier returned byGET /api/v1/users/meactiveby comparing the membership tenant withrequest.tenant_idExample relationship output:
{ "memberships": { "data": [ { "type": "memberships", "id": "membership-1", "meta": { "active": true } }, { "type": "memberships", "id": "membership-2", "meta": { "active": false } } ], "meta": { "count": 2 } } }Steps to review
GET /api/v1/users/me.meta.active: true.meta.active: false.Checklist
API
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Summary by CodeRabbit
Bug Fixes
Documentation