[CSM Portal] add case activities search passthrough route

[rksk]

Purpose

The CSM portal needs to show a case's full activity trail (comments, work notes, state transitions, and other recorded field changes) on the case view. The integration service is gaining a path-scoped POST /cases/{id}/activities/search endpoint for this, but the CSM backend (BFF) currently has no route that reaches it, so the webapp cannot fetch a case's activity trail.

This PR adds that missing passthrough route to the CSM backend so the webapp can call it through the gateway.

Goals

• Add a POST /cases/{id}/activities/search route to the CSM backend that forwards to the integration service's path-scoped POST /cases/{id}/activities/search.
• Keep the backend a thin pass-through: cap and forward the request body as-is, and return the integration-service response bytes verbatim. No parsing or reshaping of the payload.
• Document the new endpoint in the backend OpenAPI spec.

Approach

• internal/entity: added SearchCaseActivities(ctx, caseID, body) that calls the integration service's POST /cases/{id}/activities/search with the case ID path-escaped, mirroring the existing SearchCaseComments client method.
• internal/handler (cases.go): added a SearchCaseActivities handler that authenticates the request, reads the case ID from the path, caps the body at the standard 1 MiB request limit, validates that any non-empty body is valid JSON, and forwards it unchanged. Unlike the case-comments search handler (which forwards to the global /comments/search and injects referenceId/referenceType), this endpoint is path-scoped, so nothing is injected into the body. The new method is added to the local entityCaseClient interface.
• cmd/server/main.go: registered the new route next to the case-comments search route.
• openapi.yaml: documented the path plus CaseActivitySearchPayload / CaseActivity / CaseActivitySearchResponse schemas. The body may carry { pagination, includeFieldChanges? }.
• Added handler unit tests covering auth, empty case ID, oversized body, invalid JSON, verbatim body forwarding, and upstream error mapping.

The integration service that exposes POST /cases/{id}/activities/search is delivered separately (see Related PRs); this backend change depends on it being deployed.

User stories

As a CS engineer, I want to see the full activity trail of a case so I can understand its history at a glance.

Release note

Added a case activity trail search endpoint (POST /cases/{id}/activities/search) to the CSM backend.

Documentation

N/A - internal BFF passthrough route; no end-user product documentation impact. The endpoint is documented in the service's own openapi.yaml.

Training

N/A - no training-content impact.

Certification

N/A - no impact on certification exams.

Marketing

N/A - internal platform change with no marketing impact.

Automation tests

• Unit tests

  Added TestSearchCaseActivities covering: unauthenticated request, empty case ID, body exceeding the 1 MiB cap, invalid JSON body, verbatim body forwarding with case ID propagation, and upstream error mapping across all mapped status codes. make test (go vet + go test -race ./...) passes.

• Integration tests

  N/A - covered by handler-level unit tests against a mocked integration client; end-to-end wiring verified once the dependent integration-service route is deployed.

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes
• Ran FindSecurityBugs plugin and verified report? N/A - Go/TS codebase; go vet and go test -race run clean.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes

Samples

N/A - no samples related to this change.

Related PRs

• Integration-service endpoint this route forwards to: [CSM Portal] add case activities search endpoint (comments, attachments, field changes) #1062

Migrations (if applicable)

N/A - no schema or data migrations.

Test environment

• Go (module toolchain per go.mod), macOS. make build, make test, and make vet run clean.

Learning

Followed the existing SearchCaseComments handler/client pattern already established in this backend; the only deliberate deviation is not injecting referenceId/referenceType, since the new endpoint is path-scoped rather than routed through the global comments search.

[coderabbitai]

Warning

Review limit reached

@rksk, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 26 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 71abe77d-1d5b-44a9-b35f-ac6704f21c11

📥 Commits

Reviewing files that changed from the base of the PR and between 314a593 and 3bede1f.

📒 Files selected for processing (6)

• apps/csm-portal/backend/cmd/server/main.go
• apps/csm-portal/backend/internal/entity/entity.go
• apps/csm-portal/backend/internal/handler/cases.go
• apps/csm-portal/backend/internal/handler/cases_test.go
• apps/csm-portal/backend/internal/handler/helpers_test.go
• apps/csm-portal/backend/openapi.yaml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}