feat(ee): Gate service accounts behind entitlement by daryllimyt · Pull Request #2582 · TracecatHQ/tracecat

daryllimyt · 2026-04-30T00:29:45Z

Motivation

Introduce a feature flag/entitlement for service accounts so the capability can be enabled/disabled per-organization/tier.
Prevent UI and API access to service accounts when the organization's service_accounts entitlement is not enabled.

Description

Frontend: added entitlement checks via useEntitlements, render EntitlementRequiredEmptyState when service accounts are disabled, and pass enabled flags to service account hooks (useOrganizationServiceAccounts, useWorkspaceServiceAccounts, useOrganizationServiceAccountScopes, useWorkspaceServiceAccountScopes) to avoid unnecessary queries.
Frontend: hide Service Accounts links in AppSidebar and OrganizationSidebar unless service_accounts entitlement is present and entitlements have finished loading.
Backend: added SERVICE_ACCOUNTS to Entitlement enum and included service_accounts in entitlement schemas and defaults (tiers/schemas.py, tiers/enums.py, tiers/defaults.py, tiers/types.py).
Backend: enforced entitlement checks for service account endpoints and operations by wiring a router-level dependency and applying @requires_entitlement(Entitlement.SERVICE_ACCOUNTS) on service methods, and by blocking API key auth if the organization is not entitled (auth/credentials.py, service_accounts/router.py, service_accounts/service.py).

Testing

No automated tests were run as part of this change.

Codex Task

Summary by cubic

Gate service accounts behind the org service_accounts entitlement across UI and API. When not entitled, the UI hides service accounts and API key auth for service accounts is rejected to meet the API key access gating requirement.

New Features
- Added Entitlement.SERVICE_ACCOUNTS and wired service_accounts through tier schemas, types, defaults, and resolver.
- Enforced entitlement on service account routes via a router Depends and on service methods via @requires_entitlement(Entitlement.SERVICE_ACCOUNTS).
- Blocked API key authentication for service accounts when the org lacks service_accounts.
- Frontend: hide Service Accounts in sidebars; show EntitlementRequiredEmptyState on settings pages; service account hooks accept an enabled flag to skip queries when not entitled.
Migration
- Enable service_accounts for tiers/orgs that should use service accounts (defaults remain false, including OSS).

^{Written for commit 1614bb5. Summary will update on new commits. Review in cubic}

zeropath-ai · 2026-04-30T00:31:47Z

✅ No security or compliance issues detected. Reviewed everything up to 1b6c511.

Security Overview

🔎 Scanned files: 22 changed file(s)
🔗 Scan Link: https://zeropath.com/app/repositories/00dffd6c-8834-4dc9-b6d8-b44cd1622986?scanId=7793b4aa-76f7-43be-821e-7a3dd40fcbde&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► frontend/src/client/schemas.gen.ts Add service_accounts field to EffectiveEntitlements and EntitlementsDict schemas ► frontend/src/client/types.gen.ts Add service_accounts field to EffectiveEntitlements and EntitlementsDict types ► frontend/src/components/organization/org-settings-service-accounts.tsx Implement logic to display service accounts settings based on entitlements Conditionally enable/disable service account fetching based on entitlement ► frontend/src/components/organization/workspace-service-accounts.tsx Implement logic to display service accounts settings based on entitlements Conditionally enable/disable service account fetching based on entitlement ► frontend/src/components/sidebar/app-sidebar.tsx Conditionally render service accounts link in sidebar based on entitlement ► frontend/src/components/sidebar/organization-sidebar.tsx Conditionally render service accounts link in organization sidebar based on entitlement ► frontend/src/hooks/use-service-accounts.ts Add enabled parameter to useOrganizationServiceAccounts and useOrganizationServiceAccountScopes Add enabled parameter to useWorkspaceServiceAccounts and useWorkspaceServiceAccountScopes ► tests/integration/test_service_account_api_keys.py Add fixture to enable service accounts entitlement for integration tests ► tests/unit/api/test_api_service_accounts.py Add fixture to enable service accounts entitlement for unit tests ► tests/unit/test_auth_credentials_api_keys.py Add fixture to enable service accounts entitlement for unit tests Test entitlement check before workspace resolution for API key authentication ► tests/unit/test_service_accounts_audit.py Add fixture to enable service accounts entitlement for unit tests ► tests/unit/test_service_accounts_pagination.py Add fixture to enable service accounts entitlement for unit tests ► tests/unit/test_service_accounts_update.py Add fixture to enable service accounts entitlement for unit tests ► tracecat/auth/credentials.py Add entitlement check for service accounts when authenticating API keys ► tracecat/service_accounts/router.py Add dependency to require service accounts entitlement for organization and workspace routers ► tracecat/service_accounts/service.py Add @requires_entitlement decorator to service account related methods ► tracecat/tiers/defaults.py Add service_accounts to default entitlements in OSS tier ► tracecat/tiers/enums.py Add SERVICE_ACCOUNTS entitlement enum ► tracecat/tiers/schemas.py Add service_accounts field to EffectiveEntitlements schema ► tracecat/tiers/service.py Add service_accounts entitlement resolution ► tracecat/tiers/types.py Add service_accounts field to EntitlementsDict type
Configuration changes	► tests/unit/test_tier_defaults.py Add service_accounts to default entitlements in tests

cubic-dev-ai

No issues found across 13 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1614bb5020

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

cubic-dev-ai

No issues found across 19 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

Guard service account routes and hide UI when not entitled

1614bb5

daryllimyt added the codex label Apr 30, 2026 — with ChatGPT Codex Connector

daryllimyt temporarily deployed to internal-registry-ci April 30, 2026 00:29 — with GitHub Actions Inactive

daryllimyt had a problem deploying to internal-registry-ci April 30, 2026 00:30 — with GitHub Actions Failure

cubic-dev-ai Bot reviewed Apr 30, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread tracecat/service_accounts/router.py Outdated

Comment thread frontend/src/components/sidebar/app-sidebar.tsx Outdated

This comment has been minimized.

Sign in to view

daryllimyt changed the title ~~Gate service accounts behind org entitlement (frontend & backend)~~ feat(ee): Gate service accounts behind entitlement Apr 30, 2026

Gate service accounts by entitlement

c04ed84

daryllimyt temporarily deployed to internal-registry-ci April 30, 2026 14:35 — with GitHub Actions Inactive

cubic-dev-ai Bot reviewed Apr 30, 2026

View reviewed changes

Enable service account entitlement in tests

1b6c511

daryllimyt temporarily deployed to internal-registry-ci April 30, 2026 14:46 — with GitHub Actions Inactive

daryllimyt temporarily deployed to internal-registry-ci April 30, 2026 14:47 — with GitHub Actions Inactive

daryllimyt merged commit a599928 into main Apr 30, 2026
19 checks passed

daryllimyt deleted the codex/create-entitlement-for-api-key-access branch April 30, 2026 15:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(ee): Gate service accounts behind entitlement#2582

feat(ee): Gate service accounts behind entitlement#2582
daryllimyt merged 3 commits intomainfrom
codex/create-entitlement-for-api-key-access

daryllimyt commented Apr 30, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

zeropath-ai Bot commented Apr 30, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

daryllimyt commented Apr 30, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Description

Testing

Summary by cubic

Uh oh!

zeropath-ai Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

daryllimyt commented Apr 30, 2026 •

edited by cubic-dev-ai Bot

Loading

zeropath-ai Bot commented Apr 30, 2026 •

edited

Loading