NO-ISSUE: Add test for tenant visibility enforcement on creation

[jhernand]

Summary

• Remove the privileged auth.ContextWithSubject setup from the tenancy test BeforeEach, so
  tests rely on the mocked TenancyLogic rather than a system-level bypass. This better reflects
  how real requests are processed.
• Add a new test case that verifies the server returns PermissionDenied when a user tries to
  create an object with a tenant that exists in the template but is invisible to the caller.

Test plan

• Run ginkgo run -r internal --focus="Tenancy logic" and confirm all four test cases pass.

Summary by CodeRabbit

• Tests
  • Enhanced tenancy validation test suite with improved test isolation and added verification for tenant visibility permissions during object creation.

[openshift-ci-robot]

@jhernand: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

• Remove the privileged auth.ContextWithSubject setup from the tenancy test BeforeEach, so
  tests rely on the mocked TenancyLogic rather than a system-level bypass. This better reflects
  how real requests are processed.
• Add a new test case that verifies the server returns PermissionDenied when a user tries to
  create an object with a tenant that exists in the template but is invisible to the caller.

Test plan

• Run ginkgo run -r internal --focus="Tenancy logic" and confirm all four test cases pass.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

This PR modifies a tenancy-focused test suite in internal/servers/servers_tenancy_test.go. The change removes automatic injection of an auth subject into the test context during setup, adjusts the boundary of an existing test, and adds a new test case that validates the server rejects object creation when the requested tenant is not visible to the user. The new test configures mock tenancy logic to return only my-tenant as visible, attempts to create a cluster with your-tenant in metadata, and asserts the server returns a gRPC PermissionDenied error.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• osac-project/fulfillment-service#439: Both PRs modify tenancy-related server tests and auth subject/tenancy handling in internal/servers/servers_tenancy_test.go.

Suggested labels

approved, lgtm

Suggested reviewers

• eranco74
• trewest

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding a test for tenant visibility enforcement during object creation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/servers/servers_tenancy_test.go`:
- Around line 299-307: The new ClusterTemplate_builder instance is missing Title
and Description which other templates include; update the template created in
the test (the ClusterTemplate_builder used at the shown diff) to set non-empty
Title and Description fields (e.g., call Title: "..." and Description: "..." on
the same builder) so the schema/DAO validation won't fail and
Expect(err).ToNot(HaveOccurred()) can pass; ensure the builder uses the same
field names (Title and Description) as the other templates in this test file.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c79c852b-a395-4a70-a650-975f3c0562d5

📥 Commits

Reviewing files that changed from the base of the PR and between 654c83a and 9398e21.

📒 Files selected for processing (1)

• internal/servers/servers_tenancy_test.go

[CrystalChun]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: CrystalChun, jhernand

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jhernand]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jhernand]

/retest-required

[jhernand]

/retest-required