fix(auth): run generic entity E2E tests as a service principal

[anastasia-nesterenko]

Summary

Updates the direct Entities API E2E tests to authenticate as an internal service principal, matching how feature services access the entity store in production.

This is a test-only behavior correction. It does not change runtime authorization: generic Entities API CRUD remains service-only, and authenticated user principals continue to receive 403 Forbidden.

Changes

• Adds a module-scoped entity_store_sdk fixture using as_service_for.
• Uses the service-authenticated SDK for entity CRUD, listing, filtering, sorting, renaming, and cleanup.
• Keeps user-facing project operations on the existing caller SDK.
• Uses the SDK's absolute base URL for the /cluster-info E2E request.
• Clarifies the existing Rego comments describing workspace sub-resource authorization. No Rego rule or permission behavior changes.

Why

These E2E tests were calling the internal generic Entities API with user credentials. Because that API is intentionally service-only, the calls correctly returned 403.

Feature services access the entity store using a service:* principal. The tests now use the same authentication model so they validate entity-store behavior without weakening access controls.

Runtime impact

None. This PR does not change authorization policies, role definitions, or endpoint behavior.

Validation

To rerun on the final PR head:

• uv run --frozen pytest e2e/test_entities.py -v --run-e2e
• uv run --frozen ruff check e2e/test_entities.py
• git diff --check

Summary by CodeRabbit

• Tests
  • Expanded end-to-end coverage for entity creation, updates, deletion, project associations, standalone entities, listing, sorting, filtering, renaming, and automatic naming.
  • Improved cluster information checks to work reliably across configured endpoint formats.
• Documentation
  • Clarified the distinction between internal entity-store testing and user-facing feature-service testing.
  • Documented authorization behavior for workspace sub-resources and cross-workspace queries.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6574b0e1-df1c-47d7-8c1c-064159cdefbd

📥 Commits

Reviewing files that changed from the base of the PR and between 8794430 and ba32883.

📒 Files selected for processing (2)

• e2e/test_entities.py
• services/core/auth/src/nmp/core/auth/app/policies/authz.rego

🚧 Files skipped from review as they are similar to previous changes (2)

• e2e/test_entities.py
• services/core/auth/src/nmp/core/auth/app/policies/authz.rego

---

📝 Walkthrough

Walkthrough

Entity E2E tests now use service-principal credentials for entity-store operations and caller credentials for project operations. The cluster-info URL uses the SDK base URL. Authorization comments describe workspace sub-resource handling.

Changes

Internal entities E2E coverage

Layer / File(s)	Summary
Internal entity client setup e2e/test_entities.py, services/core/auth/.../authz.rego	Adds the internal SDK fixture, normalizes the cluster-info URL, and clarifies authorization comments.
CRUD and project association e2e/test_entities.py	Routes entity lifecycle and project-association operations through the internal client while retaining caller credentials for projects.
Listing, sorting, and filtering e2e/test_entities.py	Routes entity listing, sorting, search, filtering, and cleanup through the internal client.
Rename and generated-name flows e2e/test_entities.py	Routes rename and auto-generated-name coverage through the internal client, including retrieval and cleanup assertions.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: running generic entity E2E tests with service-principal authentication.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch anesterenko/aircore-771-entity-rbac-returns-403-for-authenticated-users-on-nmpdev

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	31772/40384	78.7%	63.4%
Integration Tests	18452/38314	48.2%	20.8%

[mckornfield]

is the fix just a test only fix, specifically using a different principal sdk?

[ironcommit]

Need some clarification on what is changing in the PR

[ironcommit]

LGTM

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.