fix(api): persist permission-only API keys without roles by elibosley · Pull Request #2152 · unraid/api

Eli Bosley (elibosley) · 2026-11-12T13:08:16Z

Creating a permission-only API key from the CLI fails when --roles is omitted. Default omitted roles to an empty array in ApiKeyService.create, so the key passes the existing model validation and retains only its requested permissions.

The service owns this normalization for every creation caller, including permission-only overwrites. Explicit roles and rejection of empty grants remain covered. The model and authorization rules remain unchanged.

Added seven regression cases that use the real service, model validation, JSON persistence, and disk loading in a temporary directory. CLI cases exercise permission parsing and confirm that creation does not prompt or exit.

Validation: 93 tests passed across the API key service, both existing CLI suites, the new persistence suite, and GraphQL mutations. API type checking and lint passed. Before the fix, the new suite failed on omitted-role creation and permission-only overwrite.

QA: Use the PR plugin build on a test Unraid host. Run unraid-api apikey --create --name "Array Read Test" --permissions "ARRAY:READ_ANY". Expect a key without a prompt or validation error. Inspect its key JSON privately: roles must be [], and permissions must contain only ARRAY with READ_ANY. Confirm that the key can read array data and cannot perform an ungranted operation. Repeat role-only and interactive permission-only creation, then remove the test keys. Do not attach key values to the ticket.

Work intent: permission-only CLI creation and persistence, approved by the maintainer's implementation request. Low risk: one normalization change at the existing service boundary. Live Unraid validation remains for QA.

Fixes #2151
Related to CLD-1451

Release note: Fixed permission-only API key creation from the CLI when --roles is omitted.

Summary by CodeRabbit

Bug Fixes
- API keys created without specified roles now receive an empty roles list, while explicitly provided roles are preserved.
- API-key creation continues to save roles and permissions consistently, including when updating an existing key.

coderabbitai · 2026-11-12T13:08:31Z

No actionable comments were generated in the recent review.

Walkthrough

ApiKeyService.create now stores an empty roles array when callers omit roles. CLI persistence tests cover permission-only creation, role and permission combinations, overwriting keys, and rejection when no grants are supplied.

Changes

API key creation

Layer / File(s)	Summary
Role default and persistence validation `api/src/unraid-api/auth/api-key.service.ts`, `api/src/unraid-api/cli/apikey/api-key.persistence.spec.ts`	Creation stores an empty roles array when roles are omitted. Persistence tests cover role and permission combinations, overwrite behavior, and rejection when no grants are supplied.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: pujitm

Merge Risk: Minimal · up to 13353

Permission-only API keys can now be created without roles, which fixes the reported creation failure. No merge-blocking risk is identified; live validation on an Unraid host remains for QA.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title names the main change: permission-only API keys are now persisted when roles are omitted. The raw summary confirms ApiKeyService.create defaults omitted roles to an empty array, and the new …
Linked Issues check		Issue `#2151` requires that omitting `--roles` creates a key with `roles: []` and the explicit permission, without the `Invalid data structure` error. The PR changes `ApiKeyService.create` at `api/src/u…
Out of Scope Changes check		The source change is a single-line normalization in `ApiKeyService.create`, which is the function named by the issue as the failure point. The overwrite behavior (permission-only overwrite clears role…

Full details: Title check

Explanation

The title names the main change: permission-only API keys are now persisted when roles are omitted. The raw summary confirms ApiKeyService.create defaults omitted roles to an empty array, and the new spec covers persistence of permission-only keys. The title follows the conventional commit style and is specific, so it passes.

Full details: Linked Issues check

Explanation

Issue #2151 requires that omitting --roles creates a key with roles: [] and the explicit permission, without the Invalid data structure error. The PR changes ApiKeyService.create at api/src/unraid-api/auth/api-key.service.ts from apiKey.roles = roles; to apiKey.roles = roles ?? [];. This is the normalization the issue suggests, and it is applied at the service boundary, so the CLI path reaches the model validation with an array. The explicit roles value is preserved. The PR adds a persistence suite (api/src/unraid-api/cli/apikey/api-key.persistence.spec.ts) that, per the summary, covers omitted-role creation through the real service, model validation, JSON persistence, and disk reload, and checks that the CLI does not prompt or exit. I did not read the spec body. The test claims rest on the summary and PR report. Live Unraid reproduction is left to QA, as the PR states. No coding requirement from #2151 is unmet in the reviewed code.

Full details: Out of Scope Changes check

Explanation

The source change is a single-line normalization in ApiKeyService.create, which is the function named by the issue as the failure point. The overwrite behavior (permission-only overwrite clears roles) follows from the same line and is described in the PR as intended. The model and authorization rules are unchanged according to the diff summary. The other changes are regression tests in the API key persistence spec, which support the fix. No unrelated file or change appears in the reviewed summary.

Finishing Touches

Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

_{A rabbit checks the key’s new role,
An empty list now meets the goal.
Permissions settle safe in place,
Tests trace each grant and saving case.
I nibble clover, pleased to see,
A tidy key stored faithfully.}

Recent review info

Run configuration

Source mode: Auto

Repository: Unavailable

Branch: Unavailable

File: No configuration file from this repository applied

Commit: Unavailable

Layers: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: `e56870b8-2bf7-406b-b86c-d91c6d4b2989`

Commits

Reviewing files that changed from the base of the PR and between `8e587fe` and `1335359`.

Files selected for processing: 2

`api/src/unraid-api/auth/api-key.service.ts`

`api/src/unraid-api/cli/apikey/api-key.persistence.spec.ts`

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

chatgpt-codex-connector · 2026-11-12T13:11:36Z

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-12T13:13:31.565438Z	`1335359`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

codecov · 2026-11-12T13:15:48Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.31%. Comparing base (8e587fe) to head (1335359).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2152      +/-   ##
==========================================
+ Coverage   54.28%   54.31%   +0.02%     
==========================================
  Files        1046     1046              
  Lines       73608    73608              
  Branches     8845     8861      +16     
==========================================
+ Hits        39956    39978      +22     
+ Misses      33526    33504      -22     
  Partials      126      126

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-11-12T13:16:22Z

This plugin has been deployed to Cloudflare R2 and is available for testing.
Download it at this URL:

https://preview.dl.unraid.net/unraid-api/tag/PR2152/dynamix.unraid.net.plg

fix(api): persist permission-only API keys without roles

1335359

coderabbitai Bot requested a review from Pujit Mehrotra (pujitm) November 12, 2026 13:09

coderabbitai Bot approved these changes Nov 12, 2026

View reviewed changes

linear-code Bot marked this pull request as ready for review November 12, 2026 13:11

Navigation Menu

Repository navigation

fix(api): persist permission-only API keys without roles - #2152

fix(api): persist permission-only API keys without roles#2152
Eli Bosley (elibosley) wants to merge 1 commit into
mainfrom
fix/apikey-permissions-only

Eli Bosley (elibosley) commented Nov 12, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Nov 12, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Nov 12, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Nov 12, 2026

Uh oh!

github-actions Bot commented Nov 12, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Eli Bosley (elibosley) commented Nov 12, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

chatgpt-codex-connector Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Nov 12, 2026

Codecov Report

Uh oh!

github-actions Bot commented Nov 12, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Eli Bosley (elibosley) commented Nov 12, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Nov 12, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Nov 12, 2026 •

edited

Loading