Draft: fix(cassandra): restore ESS legacy auth compatibility

[sbaum1994]

TL;DR

Restore legacy ESS Cassandra authorization compatibility for self-managed installs while the service migration from ssa_authorizations to oauth_authorizations is still in progress.

Additional Details

Supported ESS images still select ess_api.namespaces.ssa_authorizations. Fresh installs with the OAuth-only schema fail because that legacy column is absent.

This change keeps the forward OAuth migration path intact while restoring compatibility:

• adds ssa_authorizations back to the fresh ESS namespace schema
• restores the initial nvcf-api SSA authorization seed
• restores the nvct-api ESS authorization seed
• adds a forward migration that recreates and seeds ssa_authorizations if a cluster already consumed an OAuth-only migration set

The legacy column should be removed only after all supported ESS versions stop selecting it.

For the Reviewer

Please focus on migrations/cassandra/keyspaces/ess_api.

The compatibility migration is intentionally additive. It does not remove or rewrite oauth_authorizations.

For QA

Ran:

bash migrations/cassandra/tests/test-execute-sqls.sh
git diff --check

QA needed: yes. Validate a fresh self-managed install with the next 0.6.1 RC and confirm account bootstrap no longer fails on ssa_authorizations.

Issues

Closes #474

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

Summary by CodeRabbit

• New Features
  • Added support for configuring SSA authorization details for NVCF and NVCT services.
  • Added authorization metadata for the NVCF API client.
  • Preserved compatibility with older clients that still use legacy SSA authorization data.
  • Extended namespace authorization configuration with the required service credentials and issuer information.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Cassandra migrations restore the legacy ssa_authorizations column, add SSA client metadata to the NCP namespace seed, and populate SSA and NOTARY authorization records for the NVCF namespace.

Changes

Legacy SSA authorization compatibility

Layer / File(s)	Summary
Restore legacy authorization schema migrations/cassandra/keyspaces/ess_api/03_init_tables.up.sql	Adds the legacy ssa_authorizations map column to ess_api.namespaces.
Seed NCP namespace authorization data migrations/cassandra/keyspaces/ess_api/04_init_ncp_namespace.up.sql	Includes ssa_authorizations in the namespace insert and adds the nvcf-api SSA client metadata.
Restore NVCF authorization records migrations/cassandra/keyspaces/ess_api/05_add_nvct_authorizations.up.sql, migrations/cassandra/keyspaces/ess_api/09_restore_legacy_ssa_authorizations.up.sql	Adds nvct-api SSA and NOTARY entries and restores nvcf-api and nvct-api legacy SSA entries for the nvcf namespace.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: balajinvda

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The migrations restore the legacy ssa_authorizations column and seed the required SSA entries while preserving OAuth data, matching #474.
Out of Scope Changes check	✅ Passed	The changes stay focused on Cassandra migration compatibility and related authorization seeding, with no clear unrelated additions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows Conventional Commits and accurately describes the Cassandra compatibility fix in this change set.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/061-ess-ssa-cassandra-compat

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@migrations/cassandra/keyspaces/ess_api/05_add_nvct_authorizations.up.sql`:
- Around line 8-10: Make 05_add_nvct_authorizations.up.sql safe for OAuth-only
schemas by ensuring ssa_authorizations exists before the UPDATE that adds NVCT
authorizations, or defer that SSA update until
09_restore_legacy_ssa_authorizations.up.sql restores the column. Preserve both
authorization-map seeding paths and verify the migration ordering for OAuth-only
upgrades.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d50c321f-36ad-4640-9823-7bf81eec9111

📥 Commits

Reviewing files that changed from the base of the PR and between 1f8ea71 and 5fec731.

📒 Files selected for processing (4)

• migrations/cassandra/keyspaces/ess_api/03_init_tables.up.sql
• migrations/cassandra/keyspaces/ess_api/04_init_ncp_namespace.up.sql
• migrations/cassandra/keyspaces/ess_api/05_add_nvct_authorizations.up.sql
• migrations/cassandra/keyspaces/ess_api/09_restore_legacy_ssa_authorizations.up.sql

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Restore the column before this migration references it.

05_add_nvct_authorizations.up.sql runs before 09_restore_legacy_ssa_authorizations.up.sql. On clusters created with the OAuth-only schema, ssa_authorizations is absent at line 10, so this migration fails before migration 09 can add the column or seed either authorization map. Make this migration self-contained, or move the SSA update behind the schema-restoration step, and test the OAuth-only upgrade path.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@migrations/cassandra/keyspaces/ess_api/05_add_nvct_authorizations.up.sql`
around lines 8 - 10, Make 05_add_nvct_authorizations.up.sql safe for OAuth-only
schemas by ensuring ssa_authorizations exists before the UPDATE that adds NVCT
authorizations, or defer that SSA update until
09_restore_legacy_ssa_authorizations.up.sql restores the column. Preserve both
authorization-map seeding paths and verify the migration ordering for OAuth-only
upgrades.

[sbaum1994]

Closing in favor of established a v0.6.1 release branch #489