OSAC-1124: Fix Keycloak Group creation per Project

[CrystalChun]

Description

This creates the group hierarchy correctly.

Previously, the group was a flat structure of viewers and managers, and did not have the project hierarchy. If more than one project/group was created in the same organization, this would fail with the group already existing because we only had the "viewers" and "managers" groups.

This creates an actual group per project, which creates viewers and managers groups within that project.

Testing

• Build passes go build ./...
• All unit tests successfully passed
• Created integration test environment and created projects in the same organization successfully

Assisted-by: Claude Code noreply@anthropic.com

/cc @jhernand

Summary by CodeRabbit

• Refactor
  • Simplified authorization group path structure by removing the /projects/ prefix segment; groups now use a flatter hierarchy (e.g., /<project-name>/viewers instead of /projects/<project-name>/viewers).
  • Enhanced hierarchical group creation to automatically establish parent-child relationships and gracefully handle existing groups during creation.

[openshift-ci-robot]

@CrystalChun: This pull request references OSAC-1124 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Description

This creates the group hierarchy correctly.

Previously, the group was a flat structure of viewers and managers, and did not have the project hierarchy. If more than one project/group was created in the same organization, this would fail with the group already existing because we only had the "viewers" and "managers" groups.

This creates an actual group per project, which creates viewers and managers groups within that project.

Testing

• Build passes go build ./...
• All unit tests successfully passed
• Created integration test environment and created projects in the same organization successfully

Assisted-by: Claude Code noreply@anthropic.com

/cc @jhernand

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

Walkthrough

Authorization group paths shift from /projects/{project-name}/{viewers|managers} to /{project-name}/{viewers|managers}. Core change: CreateAuthorizationGroup now recursively builds full parent/child hierarchies via new helpers, handling 409 conflicts through path-based lookup. Updates propagate through resource managers and all test suites.

Changes

Authorization Group Hierarchy Refactor

Layer / File(s)	Summary
Path Format and Constants Update internal/idp/authz_constants.go, internal/idp/keycloak/authz_groups.go	Removes exported GroupPathProjects constant and updates CreateAuthorizationGroup documentation to describe hierarchical path creation without the /projects/ prefix.
Keycloak Hierarchy Creation Core internal/idp/keycloak/authz_groups.go	CreateAuthorizationGroup now parses groupPath and ensures full parent/child hierarchies exist via new internal helpers: ensureGroupHierarchy initializes caching, ensureGroupHierarchyWithCache iteratively creates each path segment with 409 conflict resolution, createOrganizationGroupWithParent chooses endpoints and extracts group IDs from Location headers, getGroupIDByPathWithOrgID recursively traverses group trees for path-based lookup, and getGroupIDByPathNoError suppresses errors as a conflict fallback.
Resource Manager Path Updates internal/idp/resource_manager.go	createProjectAuthorizationGroups and deleteProjectAuthorizationGroups update viewers/managers group path construction to /{projectName}/{groupType}, removing the prior /projects/ prefix and aligning creation and deletion operations.
Keycloak Client Unit Tests internal/idp/keycloak/client_test.go	CreateAuthorizationGroup tests validate hierarchical parent/child creation through separate Keycloak endpoints and 409 conflict handling with fallback lookup. GetGroupIDByPath tests use the new /{project}/{viewers|managers} path format and mock group search responses with matching paths.
Resource Manager Integration Tests internal/idp/resource_manager_test.go	CreateProjectAuthorizationResource and DeleteAuthorizationResource tests verify mocked group creation and ID lookup calls use the new /{project}/{viewers|managers} paths across success, creation failure, and lookup failure scenarios.
Project Reconciler Activation and Cleanup Tests internal/controllers/project/project_reconciler_function_test.go	High-level reconciler tests update expected paths in project activation (top-level, valid parent, multi-level hierarchy) and deletion cleanup to use the new /{project-title}/{viewers|managers} format, verifying end-to-end behavior with refactored hierarchy creation.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Rationale: The PR introduces substantial changes to core Keycloak group hierarchy creation logic with new caching, path traversal, and 409 conflict-resolution helpers. While the path refactor is straightforward, the implementation of recursive hierarchy building with error handling, Location header extraction, and fallback lookup mechanisms demands careful review for correctness and error cases. The changes are cohesive but require understanding the complete flow from resource manager through Keycloak client to helper functions. Test coverage is extensive but complex, verifying multiple scenarios across mock HTTP endpoints.

Possibly related PRs

• osac-project/fulfillment-service#616: Modifies internal/idp/keycloak/authz_groups.go's authorization-group creation and GetGroupIDByPath logic with overlapping changes to hierarchical group handling and path resolution.
• osac-project/fulfillment-service#600: Touches project reconciler Keycloak behavior in project_reconciler_function_test.go and would exercise the updated mocked group-path expectations for deletion cleanup.

Suggested reviewers

• jhernand
• tzvatot

Poem

🔐 Authorization paths stripped of their prefix
Now simplified to /{project}/{role}
Hierarchies built brick by brick,
Conflicts handled with recursive grace—
Full group trees grow in one embrace. 🌳

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Tools execution failed with the following error:

Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: CrystalChun, jhernand

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jhernand]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[CrystalChun]

/retest