feat: add access_profile_id to virtual keys for direct access profile assignment

[BearTS]

Summary

This PR adds support for attaching virtual keys directly to an access profile, enabling enterprise users to associate VKs with access profile templates as an alternative to team or customer assignment. Previously, virtual keys could only be assigned to a team or a customer (mutually exclusive). This change extends that model to include access profiles as a third mutually exclusive assignment target.

Changes

• Added access_profile_id column and index to governance_virtual_keys via a new database migration (migrationAddVKAccessProfileIDColumn).
• Extended TableVirtualKey with an AccessProfileID *uint field.
• Updated CreateVirtualKeyRequest and UpdateVirtualKeyRequest HTTP handler structs to accept access_profile_id, and replaced the binary team/customer mutual-exclusion check with a three-way entity count guard.
• In the update path, access_profile_id is persisted via a separate Updates call because the existing UpdateVirtualKey select list excludes it to protect config-sync paths.
• Added useGetAccessProfilesQuery stub to the OSS fallback API layer so the UI degrades gracefully when the enterprise backend is absent.
• Added GetAccessProfilesParams and GetAccessProfilesResponse types to the OSS fallback type definitions.
• Updated VirtualKeySheet to support access_profile as a form entity type, including a defaultAccessProfileId prop, a locked-assignment mode (isAPLocked), a reassignment confirmation dialog, and a combobox for selecting an access profile.
• Updated VirtualKeysTable to display an "AP: <name>" badge for VKs assigned to an access profile and to include access profile names in CSV exports.
• Registered AccessProfileVirtualKeys as a cache tag in the base RTK API.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

1. Run the service — the migration will automatically add access_profile_id to governance_virtual_keys.
2. Create a virtual key via the API with access_profile_id set and verify it is persisted.
3. Attempt to create a virtual key with both team_id and access_profile_id set — expect a 400 error.
4. Update a virtual key to assign it to an access profile and confirm the previous team/customer assignment is cleared.
5. In the UI (enterprise build), open the virtual key sheet and verify the "Assign to Access Profile" option appears when access profiles exist, the combobox populates correctly, and the reassignment warning dialog triggers when changing an already-assigned profile.
6. Verify the virtual keys table shows the "AP: <name>" badge and that CSV export includes the access profile name.

# Core/Transports
go version
go test ./...

# UI
cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build

Breaking changes

• Yes
• No

Security considerations

access_profile_id follows the same access-control patterns as team_id and customer_id. No new auth surfaces are introduced. The OSS fallback returns undefined data, ensuring no enterprise-only data is exposed in non-enterprise builds.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Virtual keys can be assigned to access profiles; listing/filtering supports access_profile_id and exports include access profile names/IDs.

• UI

  • Access profile option added to create/edit forms, with optional preselected/locked assignment and change confirmation.
  • Table shows Access Profile badges; CSV exports include access profile names.
  • OSS fallback hook and types added; combobox gains test-id prop.

• Bug Fixes / Validation

  • Create/update enforce single assignment (team, customer, or access profile) and persist consistently.

• Migrations

  • Migration adds access_profile_id column and index (idempotent; rollback supported).

Walkthrough

Adds Access Profile assignment for Virtual Keys across DB, backend, and frontend: migration and TableVirtualKey field; create/update validation and persistence; TypeScript types, fallback API, form UI with confirmation, table display, CSV exports, and a small combobox testid prop.

Changes

Virtual Key Access Profile Assignment

Layer / File(s)	Summary
Database schema and migration framework/configstore/tables/virtualkey.go, framework/configstore/migrations.go, framework/configstore/store.go, framework/configstore/rdb.go	TableVirtualKey adds optional AccessProfileID and mutual-exclusion comment. New idempotent migration creates access_profile_id column and index; query params gain AccessProfileID and paginated query supports filtering by it.
Backend request contracts and validation transports/bifrost-http/handlers/governance.go	CreateVirtualKeyRequest and UpdateVirtualKeyRequest extended with AccessProfileID. Handlers parse access_profile_id query param, validate that exactly one of team_id/customer_id/access_profile_id is set, reconcile/clear conflicting assignments, persist access_profile_id on create and via explicit Updates call on update.
Frontend types and API integration ui/lib/types/governance.ts, ui/app/_fallbacks/enterprise/lib/types/accessProfile.ts, ui/app/_fallbacks/enterprise/lib/store/apis/accessProfileApi.ts, ui/lib/store/apis/baseApi.ts, ui/lib/store/apis/governanceApi.ts	Add access_profile_id to governance types and params. Define GetAccessProfilesParams and GetAccessProfilesResponse. Provide OSS fallback hook useGetAccessProfilesQuery. Add RTK Query tag type AccessProfileVirtualKeys and include access_profile_id in governance API requests when supplied.
Virtual Key form component ui/app/workspace/virtual-keys/views/virtualKeySheet.tsx	Component accepts defaultAccessProfileId. Form schema adds entityType: "access_profile" and required accessProfileId. Loads access profiles, supports locked default assignment, clears/validates on entityType change, shows reassignment confirmation dialog on edit, and includes access_profile_id in create/update payloads.
Virtual Keys table display and CSV export ui/app/workspace/virtual-keys/views/virtualKeysTable.tsx	Load access profiles and build a name lookup. CSV export helper accepts this mapping and exports "Access Profile: <name
UI prop change ui/components/ui/combobox.tsx	Adds optional data-testid prop to ComboboxSelect props and applies it to the single-select trigger button.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Suggested reviewers

• akshaydeo
• danpiths

Poem

🐰 A key finds a profile, a new snug little den,
Migrations nibble soil, handlers tie the pen,
Forms ask twice before hopping a home,
Tables and CSVs sing names where they roam,
A rabbit applauds: tidy fields, one attachment again.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 42.86% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title clearly and concisely describes the main feature: adding access_profile_id to virtual keys for direct access profile assignment.
Description check	✅ Passed	The PR description comprehensively covers all required sections: summary, detailed changes, type of change, affected areas, testing instructions, breaking changes, security considerations, and a checklist.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-18-feat_assign_vk_to_access_profile

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[BearTS]

• feat: add access_profile_id to virtual keys for direct access profile assignment #3560 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 4/5

Safe to merge after fixing the update-handler assignment branch; the zero-value edge case can corrupt entity assignment for a VK.

The update handler's else if req.AccessProfileID != nil branch lacks the > 0 guard applied everywhere else. Sending access_profile_id: 0 in a PATCH request silently writes 0 (not NULL) to the column while also clearing the existing team_id/customer_id.

transports/bifrost-http/handlers/governance.go — the update assignment if-else chain

Important Files Changed

Filename	Overview
transports/bifrost-http/handlers/governance.go	Extends create/update/list handlers for access profile assignment. The update assignment branch lacks the > 0 guard present in both the entityCount check and the BeforeSave hook.
ui/app/workspace/virtual-keys/views/virtualKeySheet.tsx	Adds full access-profile assignment UI: form schema extension, locked-assignment mode, reassignment confirmation dialogs, and combobox.
framework/configstore/tables/virtualkey.go	Adds AccessProfileID *uint field and updates BeforeSave to a three-way mutual-exclusion count using a consistent > 0 guard.
framework/configstore/migrations.go	Adds migrationAddVKAccessProfileIDColumn with idempotent column/index creation and rollback support.
ui/app/workspace/virtual-keys/views/virtualKeysTable.tsx	Adds AP badge display and CSV export support using a memoised id-to-name map.

_{Reviews (4): Last reviewed commit: "feat: assign VK to access profile" | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@framework/configstore/tables/virtualkey.go`:
- Around line 208-212: Update the VirtualKey model's BeforeSave hook to enforce
full 3-way exclusivity for TeamID, CustomerID, and AccessProfileID (not just
Team+Customer): in BeforeSave (on VirtualKey) count how many of TeamID != nil,
CustomerID != nil, and AccessProfileID != nil/zero are set and return an error
if more than one is set (and optionally validate if zero set is allowed by your
domain rules); ensure you treat AccessProfileID's zero value correctly when
checking. This centralizes the invariant so non-handler write paths cannot
create invalid combinations.

In `@ui/app/workspace/virtual-keys/views/virtualKeySheet.tsx`:
- Around line 1323-1354: The Reassign AP dialog's interactive elements lack
data-testid attributes; add data-testid to the AlertDialogCancel and
AlertDialogAction (e.g., data-testid="reassign-ap-cancel" and
data-testid="reassign-ap-confirm") inside the showReassignAPWarning block and
also add a data-testid to the access profile selector control used to pick
pendingAccessProfileId (e.g., data-testid="access-profile-selector") so E2E
tests can reliably target form.setValue("accessProfileId", ...) flows and the AP
selector component.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: efba1e25-5ec5-45e5-bf15-c7e7e3a80030

📥 Commits

Reviewing files that changed from the base of the PR and between 89a99f0 and 781c9a0.

📒 Files selected for processing (9)

• framework/configstore/migrations.go
• framework/configstore/tables/virtualkey.go
• transports/bifrost-http/handlers/governance.go
• ui/app/_fallbacks/enterprise/lib/store/apis/accessProfileApi.ts
• ui/app/_fallbacks/enterprise/lib/types/accessProfile.ts
• ui/app/workspace/virtual-keys/views/virtualKeySheet.tsx
• ui/app/workspace/virtual-keys/views/virtualKeysTable.tsx
• ui/lib/store/apis/baseApi.ts
• ui/lib/types/governance.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@framework/configstore/tables/virtualkey.go`:
- Around line 208-211: The model currently treats any non-nil AccessProfileID
pointer as an assignment, allowing access_profile_id: 0 to bypass exclusivity
checks; update the validation where the struct's foreign-key exclusivity is
evaluated (the logic that inspects TeamID, CustomerID, and AccessProfileID) to
only count AccessProfileID when it is non-nil AND *AccessProfileID > 0 (i.e.,
treat zero as unset), so change checks like "if v.AccessProfileID != nil" to "if
v.AccessProfileID != nil && *v.AccessProfileID > 0" wherever exclusivity or
presence is computed for virtual key attachments.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f9703e87-719d-4f9e-95a4-bb129e42e62a

📥 Commits

Reviewing files that changed from the base of the PR and between 781c9a0 and 2527351.

📒 Files selected for processing (10)

• framework/configstore/migrations.go
• framework/configstore/tables/virtualkey.go
• transports/bifrost-http/handlers/governance.go
• ui/app/_fallbacks/enterprise/lib/store/apis/accessProfileApi.ts
• ui/app/_fallbacks/enterprise/lib/types/accessProfile.ts
• ui/app/workspace/virtual-keys/views/virtualKeySheet.tsx
• ui/app/workspace/virtual-keys/views/virtualKeysTable.tsx
• ui/components/ui/combobox.tsx
• ui/lib/store/apis/baseApi.ts
• ui/lib/types/governance.ts

🚧 Files skipped from review as they are similar to previous changes (7)

• ui/lib/store/apis/baseApi.ts
• transports/bifrost-http/handlers/governance.go
• ui/app/workspace/virtual-keys/views/virtualKeysTable.tsx
• ui/lib/types/governance.ts
• ui/app/_fallbacks/enterprise/lib/store/apis/accessProfileApi.ts
• framework/configstore/migrations.go
• ui/app/workspace/virtual-keys/views/virtualKeySheet.tsx

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@framework/configstore/rdb.go`:
- Around line 2284-2285: The access-profile check is currently in an "else if"
so when team_id/customer_id filters are applied the access_profile_id condition
is dropped; change the logic so access_profile_id is included in the same
multi-filter OR group instead of being mutually exclusive: remove the "else if
params.AccessProfileID" exclusivity and, when building the Where group that
contains team_id and customer_id, add an "OR access_profile_id = ?" clause when
params.AccessProfileID > 0 (using the same baseQuery.Where call), referencing
params.AccessProfileID and the existing baseQuery.Where that uses
team_id/customer_id so the access-profile filter participates in the OR logic
rather than being ignored.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1f21dbca-843d-4fe5-9123-29e0c5b9e209

📥 Commits

Reviewing files that changed from the base of the PR and between 2527351 and 243adc1.

📒 Files selected for processing (13)

• framework/configstore/migrations.go
• framework/configstore/rdb.go
• framework/configstore/store.go
• framework/configstore/tables/virtualkey.go
• transports/bifrost-http/handlers/governance.go
• ui/app/_fallbacks/enterprise/lib/store/apis/accessProfileApi.ts
• ui/app/_fallbacks/enterprise/lib/types/accessProfile.ts
• ui/app/workspace/virtual-keys/views/virtualKeySheet.tsx
• ui/app/workspace/virtual-keys/views/virtualKeysTable.tsx
• ui/components/ui/combobox.tsx
• ui/lib/store/apis/baseApi.ts
• ui/lib/store/apis/governanceApi.ts
• ui/lib/types/governance.ts

✅ Files skipped from review due to trivial changes (2)

• ui/lib/store/apis/governanceApi.ts
• ui/lib/store/apis/baseApi.ts

🚧 Files skipped from review as they are similar to previous changes (9)

• ui/lib/types/governance.ts
• ui/app/_fallbacks/enterprise/lib/types/accessProfile.ts
• ui/components/ui/combobox.tsx
• ui/app/workspace/virtual-keys/views/virtualKeysTable.tsx
• transports/bifrost-http/handlers/governance.go
• framework/configstore/migrations.go
• ui/app/_fallbacks/enterprise/lib/store/apis/accessProfileApi.ts
• framework/configstore/tables/virtualkey.go
• ui/app/workspace/virtual-keys/views/virtualKeySheet.tsx

[coderabbitai]

Actionable comments posted: 1

♻️ Duplicate comments (1)

framework/configstore/tables/virtualkey.go (1)

208-212: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Reject access_profile_id = 0 in the model hook.

BeforeSave currently treats AccessProfileID == 0 as “not counted” but still valid, so non-handler write paths can persist an impossible attachment state. Reject 0 explicitly instead of silently ignoring it.

Proposed fix

-	if vk.AccessProfileID != nil && *vk.AccessProfileID > 0 {
-		entityCount++
-	}
+	if vk.AccessProfileID != nil {
+		if *vk.AccessProfileID == 0 {
+			return fmt.Errorf("access profile id must be greater than 0")
+		}
+		entityCount++
+	}

Also applies to: 251-262

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@framework/configstore/tables/virtualkey.go` around lines 208 - 212, The
BeforeSave hook should explicitly reject an AccessProfileID value of 0 instead
of treating it as "not counted": in the virtualkey model's BeforeSave (and the
equivalent hook around the AccessProfileID checks later in the file) add a
validation that if AccessProfileID != nil and *AccessProfileID == 0, return a
descriptive error (e.g., fmt.Errorf("access_profile_id cannot be 0")), so writes
that try to persist a zero ID are rejected; update both places that currently
ignore zero to perform this explicit nil-and-zero check against AccessProfileID.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@transports/bifrost-http/handlers/governance.go`:
- Around line 94-97: The incoming requests currently allow access_profile_id ==
0 to pass the HTTP boundary, which breaks exclusivity logic and causes silent
filtering or server errors; update the request validation in the governance
handlers to explicitly reject access_profile_id values equal to 0 with a 400
before any business/query logic runs. Locate where the request structs (fields
TeamID, CustomerID, AccessProfileID) are parsed in the handlers for GET/POST/PUT
(e.g., the create/update/list governance handlers in governance.go) and add a
guard that treats AccessProfileID != nil && *AccessProfileID == 0 as invalid,
returning an immediate HTTP 400 with a clear message; apply the same check
wherever access_profile_id is read from input (the spots noted in the comment
ranges) so filters and persistence never receive a zero ID.

---

Duplicate comments:
In `@framework/configstore/tables/virtualkey.go`:
- Around line 208-212: The BeforeSave hook should explicitly reject an
AccessProfileID value of 0 instead of treating it as "not counted": in the
virtualkey model's BeforeSave (and the equivalent hook around the
AccessProfileID checks later in the file) add a validation that if
AccessProfileID != nil and *AccessProfileID == 0, return a descriptive error
(e.g., fmt.Errorf("access_profile_id cannot be 0")), so writes that try to
persist a zero ID are rejected; update both places that currently ignore zero to
perform this explicit nil-and-zero check against AccessProfileID.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2cf0caf3-025f-4878-a092-8ea3e61333d5

📥 Commits

Reviewing files that changed from the base of the PR and between 243adc1 and 8fe228b.

📒 Files selected for processing (13)

• framework/configstore/migrations.go
• framework/configstore/rdb.go
• framework/configstore/store.go
• framework/configstore/tables/virtualkey.go
• transports/bifrost-http/handlers/governance.go
• ui/app/_fallbacks/enterprise/lib/store/apis/accessProfileApi.ts
• ui/app/_fallbacks/enterprise/lib/types/accessProfile.ts
• ui/app/workspace/virtual-keys/views/virtualKeySheet.tsx
• ui/app/workspace/virtual-keys/views/virtualKeysTable.tsx
• ui/components/ui/combobox.tsx
• ui/lib/store/apis/baseApi.ts
• ui/lib/store/apis/governanceApi.ts
• ui/lib/types/governance.ts

🚧 Files skipped from review as they are similar to previous changes (8)

• ui/app/_fallbacks/enterprise/lib/store/apis/accessProfileApi.ts
• ui/lib/store/apis/governanceApi.ts
• framework/configstore/migrations.go
• ui/lib/types/governance.ts
• ui/app/_fallbacks/enterprise/lib/types/accessProfile.ts
• framework/configstore/rdb.go
• ui/app/workspace/virtual-keys/views/virtualKeysTable.tsx
• ui/app/workspace/virtual-keys/views/virtualKeySheet.tsx

[akshaydeo]

Merge activity

• May 19, 7:54 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 19, 7:55 AM UTC: @akshaydeo merged this pull request with Graphite.