Introduce User Sharing API v2#1044
Merged
BimsaraBodaragama merged 33 commits intowso2:masterfrom Feb 23, 2026
Merged
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds a v2 organization user-sharing management module: new Maven module and parent registration, OpenAPI v3 spec for v2, core service + factory + impl wired to a V2 backend, a V2 service holder accessor, new constants and error codes, and an organization-management dependency version bump. Changes
Sequence DiagramsequenceDiagram
participant Client as Client
participant Impl as UsersApiServiceImpl (v2)
participant Core as UsersApiServiceCore (v2)
participant Backend as UserSharingPolicyHandlerServiceV2
Client->>Impl: HTTP request (e.g., POST /users/share)
Impl->>Core: delegate(request)
Core->>Core: validate & map -> DO
Core->>Backend: perform operation(DO)
Backend-->>Core: result / error
Core->>Core: map result -> API response, build links
Core-->>Impl: Response
Impl-->>Client: HTTP response
Estimated Code Review Effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
9 tasks
![wso2-engineering[bot]](https://avatars.githubusercontent.com/in/1856828?s=60&v=4){kind=small}
There was a problem hiding this comment.
AI Agent Log Improvement Checklist
- The log-related comments and suggestions in this review were generated by an AI tool to assist with identifying potential improvements. Purpose of reviewing the code for log improvements is to improve the troubleshooting capabilities of our products.
- Please make sure to manually review and validate all suggestions before applying any changes. Not every code suggestion would make sense or add value to our purpose. Therefore, you have the freedom to decide which of the suggestions are helpful.
✅ Before merging this pull request:
- Review all AI-generated comments for accuracy and relevance.
- Complete and verify the table below. We need your feedback to measure the accuracy of these suggestions and the value they add. If you are rejecting a certain code suggestion, please mention the reason briefly in the suggestion for us to capture it.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (5)
components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/factories/UsersApiServiceCoreFactory.java (1)
30-49: Static initializer hides the intendedIllegalStateExceptionfrom callersThrowing
IllegalStateExceptionin the static block will surface to callers asExceptionInInitializerError, so theIllegalStateExceptioncatch inUsersApiServiceImplwill never see it. If you want the API layer to consistently getIllegalStateExceptionfrom the factory, consider moving the null‑check and construction intogetUsersApiServiceCore()(lazy init) instead of the static block.One possible refactor:
- private static final UsersApiServiceCore SERVICE; - - static { - UserSharingPolicyHandlerService userSharingPolicyHandlerService = UserSharingMgtServiceHolder - .getUserSharingPolicyHandlerService(); - if (userSharingPolicyHandlerService == null) { - throw new IllegalStateException("UserSharingPolicyHandlerService is not available from the OSGi context."); - } - SERVICE = new UsersApiServiceCore(userSharingPolicyHandlerService); - } + private static volatile UsersApiServiceCore service; @@ - public static UsersApiServiceCore getUsersApiServiceCore() { - - return SERVICE; - } + public static UsersApiServiceCore getUsersApiServiceCore() { + + if (service == null) { + synchronized (UsersApiServiceCoreFactory.class) { + if (service == null) { + UserSharingPolicyHandlerService userSharingPolicyHandlerService = + UserSharingMgtServiceHolder.getUserSharingPolicyHandlerService(); + if (userSharingPolicyHandlerService == null) { + throw new IllegalStateException( + "UserSharingPolicyHandlerService is not available from the OSGi context."); + } + service = new UsersApiServiceCore(userSharingPolicyHandlerService); + } + } + } + return service; + }components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/impl/UsersApiServiceImpl.java (1)
43-50: Constructor’sIllegalStateExceptioncatch won’t see static‑init failures from the factoryGiven the current factory implementation, a missing
UserSharingPolicyHandlerServicewill throwIllegalStateExceptionfrom a static initializer, which reaches this constructor asExceptionInInitializerError, bypassing theIllegalStateExceptioncatch.If you don’t refactor the factory, consider broadening the catch here; if you do refactor as suggested in the factory comment, this constructor will then work as intended.
Example if you keep the static initializer:
- try { - this.usersApiServiceCore = UsersApiServiceCoreFactory.getUsersApiServiceCore(); - } catch (IllegalStateException e) { - throw new RuntimeException(ERROR_INITIATING_USERS_API_SERVICE.getMessage(), e); - } + try { + this.usersApiServiceCore = UsersApiServiceCoreFactory.getUsersApiServiceCore(); + } catch (IllegalStateException | ExceptionInInitializerError e) { + throw new RuntimeException(ERROR_INITIATING_USERS_API_SERVICE.getMessage(), e); + }components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/resources/organization-user-share-v2.yaml (3)
455-465: UnboundeduserIdsarray may be problematic; consider addingmaxItems
UserCriteria.userIdsis required but unconstrained in size. For bulk operations like share/unshare, this can invite very large payloads and DoS‑type scenarios. If the backend already enforces a sensible cap, it’s worth reflecting that here with amaxItems(and optionallyminItems) so clients have a clear contract.For example (adjust the limit to match server behavior):
userIds: type: array description: List of user IDs. items: type: string + maxItems: 1000
435-449: Clarify that BasicAuth/OAuth2 credentials must only be used over TLSStatic analysis flagged the securitySchemes because HTTP auth can expose credentials over cleartext if used on plain HTTP. Your examples and OAuth2 URLs already use
https, but the spec itself doesn’t state the TLS requirement.I’d recommend explicitly documenting that these endpoints are only supported over HTTPS (and that HTTP is not allowed in production), to satisfy tooling and avoid misconfiguration.
753-765: AlignError.codeexample prefix with actual error prefixThe
Error.codeexample uses"US-00000", whileUserSharingMgtConstants.ERROR_PREFIXis"USM-". To avoid confusion for integrators, it’s better if the example matches the real prefix.- code: - type: string - example: "US-00000" + code: + type: string + example: "USM-00000"
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (20)
components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/UsersApi.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/UsersApiService.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/factories/UsersApiServiceFactory.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/Error.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/Link.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/ProcessSuccessResponse.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/RoleAssignment.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/RoleShareConfig.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/RoleShareConfigAudience.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/SharingMode.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/UserCriteria.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/UserOrgShareConfig.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/UserShareAllRequestBody.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/UserShareSelectedRequestBody.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/UserSharedOrganization.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/UserSharedOrganizationsResponse.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/UserSharingPatchOperation.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/UserSharingPatchRequest.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/UserUnshareAllRequestBody.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/gen/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/model/UserUnshareSelectedRequestBody.javais excluded by!**/gen/**
📒 Files selected for processing (6)
components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/pom.xml(1 hunks)components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/core/UsersApiServiceCore.java(1 hunks)components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/factories/UsersApiServiceCoreFactory.java(1 hunks)components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/impl/UsersApiServiceImpl.java(1 hunks)components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/resources/organization-user-share-v2.yaml(1 hunks)components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/pom.xml(1 hunks)
🧰 Additional context used
🧬 Code graph analysis (1)
components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/impl/UsersApiServiceImpl.java (3)
components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/core/UsersApiServiceCore.java (1)
UsersApiServiceCore(35-82)components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/v2/factories/UsersApiServiceCoreFactory.java (1)
UsersApiServiceCoreFactory(28-50)components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.common/src/main/java/org/wso2/carbon/identity/api/server/organization/user/sharing/management/common/constants/UserSharingMgtConstants.java (1)
UserSharingMgtConstants(24-101)
🪛 Checkov (3.2.334)
components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/resources/organization-user-share-v2.yaml
[medium] 460-465: Ensure that arrays have a maximum number of items
(CKV_OPENAPI_21)
[high] 438-441: Ensure that security schemes don't allow cleartext credentials over unencrypted channel - version 3.x.y files
(CKV_OPENAPI_3)
🔇 Additional comments (2)
components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/pom.xml (1)
31-35: V2 module wiring in parent POM looks consistentAdding the v2 module alongside v1 and
commonmatches the expected multi‑module structure for versioned APIs.components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/pom.xml (1)
31-172: POM configuration for the v2 module looks fine; just ensure generated sources are presentDependencies and build plugins align with other JAX‑RS/OpenAPI modules (provided scopes,
build-helper-maven-pluginforsrc/gen/java, Java 8 compiler settings). From a POM perspective this looks good.Just make sure that the generated sources for
src/gen/java(e.g.,UsersApiServiceinterface) are either checked in or produced by your build pipeline, since the openapi‑generator plugin here is commented out.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces a new versioned User Sharing API (v2) under /api/server/v2/users/** to address limitations of the existing v1 endpoints. The new API follows the Application Sharing pattern and enables incremental role assignment with selective sharing across hierarchical organizations.
Key Changes:
- Added 6 new REST endpoints for user sharing operations (share, unshare, patch, and query)
- Introduced role assignment modes (NONE, SELECTED) with SCIM-style PATCH semantics for incremental updates
- Implemented paginated retrieval of shared organizations with per-organization role visibility
Reviewed changes
Copilot reviewed 26 out of 26 changed files in this pull request and generated 20 comments.
Show a summary per file
| File | Description |
|---|---|
| pom.xml (parent) | Added v2 module to the parent POM build configuration |
| organization-user-share-v2.yaml | OpenAPI 3.0 specification defining the v2 API endpoints, schemas, and examples |
| UsersApiServiceImpl.java | Implementation delegating API calls to the core service layer |
| UsersApiServiceCore.java | Core business logic with placeholder methods for all v2 operations |
| UsersApiServiceCoreFactory.java | Factory pattern for initializing the core service with OSGi dependencies |
| Model classes (20 files) | Auto-generated DTOs from OpenAPI spec for request/response handling |
| UsersApi.java | JAX-RS resource class with endpoint mappings and validation |
| UsersApiService.java | Service interface defining the API contract |
| UsersApiServiceFactory.java | Factory for service instantiation |
| pom.xml (v2 module) | Maven configuration with dependencies and build plugins |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
AnuradhaSK
reviewed
Dec 10, 2025
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In
`@components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/resources/organization-user-share-v2.yaml`:
- Around line 610-627: The PATCH schema currently lists only "op" and "path" as
required while the "value" property is used by operations (add/remove); either
add "value" to the required array so RoleShareConfig lists must be provided for
add/remove, or explicitly document the remove-all semantics for when "value" is
omitted; update the schema's required list to include "value" if the backend
requires it (refer to the "value" property and the "op" values `add`/`remove`)
or add a clear description under "value" and in the "op" description explaining
behavior when "value" is absent (e.g., remove-all) so consumers know which
behavior is supported.
- Around line 699-713: The SharingMode.policy description currently only
documents the global policy and can mislead clients when used in
per-organization contexts (e.g., UserSharedOrganization); update the OpenAPI
schema for SharingMode.policy to enumerate all valid policy values used across
contexts (both global and per-organization selected-org policies) or create a
separate schema (e.g., SharingModePerOrg) for per-organization usage and
reference that from UserSharedOrganization; ensure the chosen approach updates
the description and the required/enum values so responses and request models
accurately reflect valid values for each context.
🧹 Nitpick comments (1)
components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/resources/organization-user-share-v2.yaml (1)
483-492: Add explicit size bounds for request arrays.Arrays like
userIds,orgIds,organizations,roles, andOperationsare unbounded. Please reflect server-side limits withminItems/maxItemsso clients and tooling can validate payload sizes and avoid oversized requests.🛠️ Example fix (adjust maxItems to your enforced limit)
UserCriteria: type: object description: Criteria for selecting users to share/unshare. properties: userIds: type: array description: List of user IDs. + minItems: 1 + maxItems: 1000 items: type: string
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/resources/organization-user-share-v2.yaml (2)
522-529: Missingenumconstraints onpolicy(inUserOrgShareConfig,UserShareAllRequestBody) andop(inUserSharingPatchOperation).Each of these fields documents a fixed set of valid values in its description, but the schema does not enforce them with an
enum. This means OpenAPI validators and code generators treat them as unconstrained strings, allowing invalid values to pass schema validation silently.📋 Proposed additions
# UserOrgShareConfig.policy (lines 522-529) policy: type: string + enum: + - SELECTED_ORG_ONLY + - SELECTED_ORG_WITH_ALL_EXISTING_AND_FUTURE_CHILDREN description: |- Sharing scope for this organization. # UserShareAllRequestBody.policy (lines 546-552) policy: type: string + enum: + - ALL_EXISTING_AND_FUTURE_ORGS description: |- Global sharing policy. # UserSharingPatchOperation.op (lines 615-617) op: type: string + enum: + - add + - remove description: "Operation type. Supported values: `add`, `remove`."🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/resources/organization-user-share-v2.yaml` around lines 522 - 529, The OpenAPI schema fails to enforce the documented fixed values for the policy and op fields; update the YAML schemas for UserOrgShareConfig and UserShareAllRequestBody to add an enum for the policy property with values ["SELECTED_ORG_ONLY","SELECTED_ORG_WITH_ALL_EXISTING_AND_FUTURE_CHILDREN"], and update the UserSharingPatchOperation schema to add an enum for the op property with the allowed operation strings documented elsewhere (e.g., "add","remove","replace" or the exact operation names used in your API); ensure the enum arrays exactly match the values described and keep the existing description text.
70-91: Add401,403, and (for GET)404responses across all operations.All six operations only document
4xxas400. Since security scopes are declared,401 Unauthorized(invalid/missing token) and403 Forbidden(valid token, insufficient scope) are real failure paths that client code must handle.GET /users/{userId}/sharealso needs404for an unknownuserId.📋 Suggested additions (representative, apply the pattern to all operations)
# On POST /users/share, PATCH /users/share, POST /users/share-with-all, # POST /users/unshare, POST /users/unshare-with-all responses: + "401": + description: Unauthorized + content: + application/json: + schema: + $ref: "#/components/schemas/Error" + "403": + description: Forbidden + content: + application/json: + schema: + $ref: "#/components/schemas/Error" # Additionally on GET /users/{userId}/share responses: + "401": + description: Unauthorized + content: + application/json: + schema: + $ref: "#/components/schemas/Error" + "403": + description: Forbidden + content: + application/json: + schema: + $ref: "#/components/schemas/Error" + "404": + description: User not found + content: + application/json: + schema: + $ref: "#/components/schemas/Error"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/resources/organization-user-share-v2.yaml` around lines 70 - 91, The OpenAPI responses are missing 401 and 403 (and 404 for the GET /users/{userId}/share operation); update each operation's responses block to include entries for "401" and "403" that use the existing Error schema (components/schemas/Error) with appropriate description text (e.g., "Unauthorized" and "Forbidden"), and for the GET operation also add a "404" response using the same Error schema for unknown userId; apply this pattern to all six operations in the YAML so client code can handle missing/invalid tokens and insufficient scopes (and not-found for GET).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/resources/organization-user-share-v2.yaml`:
- Around line 489-494: Add a reasonable upper bound to unbounded array schemas
to prevent DoS by large payloads: for the array fields userIds, organizations,
Operations (items under the patch ops array), the value property in the
UserSharingPatchOperation schema, and roles in the RoleAssignment schema, add a
maxItems (e.g., maxItems: 100) to each array definition in the OpenAPI YAML;
update the schemas that declare type: array for those named properties so the
top-level input arrays enforce the limit.
- Around line 530-534: The roleAssignment property currently places a
description next to a $ref which OpenAPI 3.0 ignores; replace each occurrence
(the roleAssignment entries referencing RoleAssignment) with an allOf array that
first $ref's "#/components/schemas/RoleAssignment" and then a separate schema
object containing the description text (so the description is preserved). Apply
this change to both roleAssignment occurrences that reference RoleAssignment.
---
Duplicate comments:
In
`@components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/resources/organization-user-share-v2.yaml`:
- Around line 382-389: The "attributes" parameter lacks an enum constraint—add
an enum to the attributes schema to explicitly list the allowed values
["roles","sharingMode"] so tooling and validation enforce the documented
options; update the schema for the parameter named attributes in the
organization-user-share-v2.yaml operation (schema.type: string for parameter
attributes) to include the enum with those two strings and keep the existing
description and example unchanged.
- Around line 598-628: Rename the top-level schema key "Operations" to
"operations" to match camelCase used across the spec (or, if PascalCase is
intentional for SCIM alignment, add a clear description comment explaining the
deviation) and update the UserSharingPatchOperation schema to include "value" in
its required array so that op/path without a roles list is invalid; specifically
modify the "UserSharingPatchOperation" required list to add "value" and ensure
the "value" property remains typed as an array of RoleShareConfig.
- Around line 700-714: The SharingMode.policy description only documents
ALL_EXISTING_AND_FUTURE_ORGS but omits
SELECTED_ORG_WITH_ALL_EXISTING_AND_FUTURE_CHILDREN referenced elsewhere (e.g.,
UserSharedOrganization.sharingMode); update the SharingMode.policy schema
description to list all valid policy values (including
SELECTED_ORG_WITH_ALL_EXISTING_AND_FUTURE_CHILDREN) and briefly describe each
value so API consumers can understand all possible responses.
- Around line 464-469: Update the OpenAPI securitySchemes entry for BasicAuth to
explicitly state transport must be TLS: add a description under the BasicAuth
scheme (securitySchemes -> BasicAuth) that says credentials must only be sent
over HTTPS/TLS (e.g., "Only use over HTTPS/TLS; do not send credentials over
plain HTTP") so the spec documents the transport constraint and resolves the
Checkov CKV_OPENAPI_3 flag; keep the OAuth2 entry unchanged.
---
Nitpick comments:
In
`@components/org.wso2.carbon.identity.api.server.organization.user.sharing.management/org.wso2.carbon.identity.api.server.organization.user.sharing.management.v2/src/main/resources/organization-user-share-v2.yaml`:
- Around line 522-529: The OpenAPI schema fails to enforce the documented fixed
values for the policy and op fields; update the YAML schemas for
UserOrgShareConfig and UserShareAllRequestBody to add an enum for the policy
property with values
["SELECTED_ORG_ONLY","SELECTED_ORG_WITH_ALL_EXISTING_AND_FUTURE_CHILDREN"], and
update the UserSharingPatchOperation schema to add an enum for the op property
with the allowed operation strings documented elsewhere (e.g.,
"add","remove","replace" or the exact operation names used in your API); ensure
the enum arrays exactly match the values described and keep the existing
description text.
- Around line 70-91: The OpenAPI responses are missing 401 and 403 (and 404 for
the GET /users/{userId}/share operation); update each operation's responses
block to include entries for "401" and "403" that use the existing Error schema
(components/schemas/Error) with appropriate description text (e.g.,
"Unauthorized" and "Forbidden"), and for the GET operation also add a "404"
response using the same Error schema for unknown userId; apply this pattern to
all six operations in the YAML so client code can handle missing/invalid tokens
and insufficient scopes (and not-found for GET).
|
PR builder started |
|
PR builder completed |
jenkins-is-staging
approved these changes
Feb 20, 2026
jenkins-is-staging
left a comment
jenkins-is-staging
left a comment
There was a problem hiding this comment.
Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/22225962924
|
PR builder started |
|
PR builder completed |
jenkins-is-staging
approved these changes
Feb 23, 2026
jenkins-is-staging
left a comment
jenkins-is-staging
left a comment
There was a problem hiding this comment.
Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/22294699744
SujanSanjula96
previously approved these changes
Feb 23, 2026
AnuradhaSK
approved these changes
Feb 23, 2026
This was referenced Mar 10, 2026
Restructure shared user sharing mode resolution
wso2-extensions/identity-organization-management#611
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
This PR introduces a new versioned User Sharing API (
/api/server/v2/users/**) to address functional and frontend limitations of the existing/api/server/v1/users/**endpoints.The new API aligns conceptually and structurally with the Application Sharing API and enables incremental role assignment and selective sharing across hierarchical organizations.
Goals
roleAssignmentobject with supported modes:NONE | SELECTED./v1integrations.Approach
/api/server/v2/users/**:roleAssignmentto reflect role assignment semantics in sub-organizations.NONEandSELECTED, consistent with the Application Sharing model.Related PRs
Related Issues
Summary by CodeRabbit
New Features
Documentation
Chores
Maintenance