src/common/infra/ofga.rs (1)

198-208: Consider batching pipeline migrations for better performance.

The current implementation fetches all pipelines for each organization at once. For organizations with many pipelines, this could lead to memory pressure.

Consider implementing batch processing:

1. Fetch pipelines in chunks
2. Process each chunk before fetching the next
3. Add progress logging

Would you like me to provide an example implementation with batching?

src/common/utils/auth.rs (1)

343-347: LGTM! Consider adding a clarifying comment.

The exclusion of streams and pipelines from the PUT method condition correctly fixes the RBAC permission logic. This change ensures proper authorization checks for pipeline operations.

Consider adding a comment to explain why streams and pipelines require different handling:

            } else if method.eq("PUT")
+               // Streams and pipelines have special handling for PUT operations
+               // as they require different permission checks
                && path_columns[1] != "streams"
                && path_columns[1] != "pipelines"
                || method.eq("DELETE")

Configuration used: CodeRabbit UI
Review profile: CHILL

#!/bin/bash
# Check if other endpoints have RBAC checks
rg -A 5 "list_objects_for_user.*pipeline" 

web/src/components/iam/roles/EditRole.vue (1)

1437-1447: Consider enhancing error handling and type safety.

The implementation follows the established pattern and correctly integrates with the pipeline service. However, consider these improvements:

1. Add error handling to catch and properly handle API failures
2. Add TypeScript type annotations for better code maintainability

-const getPipelines = async () => {
+const getPipelines = async (): Promise<void> => {
   try {
     const pipelines = await pipelineService.getPipelines(
       store.state.selectedOrganization.identifier
     );
 
     updateResourceEntities("pipeline", ["name"], [...pipelines.data.list]);
   } catch (error) {
+    console.error('Failed to fetch pipelines:', error);
+    throw error;
   }
-  return new Promise((resolve) => {
-    resolve(true);
-  });
 };

Configuration used: CodeRabbit UI
Review profile: CHILL

Configuration used: CodeRabbit UI
Review profile: CHILL

src/common/infra/ofga.rs (1)

201-216: Consider transaction safety for pipeline migration

While the error handling is robust, the pipeline migration process might leave the system in an inconsistent state if it fails partway through. Consider:

1. Collecting all tuples first
2. Performing the update in a single transaction

Here's a suggested approach:

 if need_pipeline_migration {
+    let mut pipeline_tuples = Vec::new();
     match db::pipeline::list_by_org(org_name).await {
         Ok(pipelines) => {
             for pipeline in pipelines {
-                add_tuple_for_pipeline(org_name, &pipeline.name, &mut tuples);
+                add_tuple_for_pipeline(org_name, &pipeline.name, &mut pipeline_tuples);
             }
+            // Add all pipeline tuples at once
+            tuples.extend(pipeline_tuples);
         }
         Err(e) => {
             log::error!(
                 "Failed to migrate RBAC for org {} pipelines: {}",
                 org_name,
                 e
             );
         }
     }
 }

Configuration used: CodeRabbit UI
Review profile: CHILL

web/src/components/iam/roles/EditRole.vue (1)

1437-1447: Consider adding error handling for pipeline fetching.

The implementation follows the established pattern and correctly integrates with the existing resource entity management. However, consider adding error handling to match the robustness of a production system.

 const getPipelines = async () => {
-  const pipelines = await pipelineService.getPipelines(
-    store.state.selectedOrganization.identifier
-  );
+  try {
+    const pipelines = await pipelineService.getPipelines(
+      store.state.selectedOrganization.identifier
+    );
 
-  updateResourceEntities("pipeline", ["name"], [...pipelines.data.list]);
+    updateResourceEntities("pipeline", ["name"], [...pipelines.data.list]);
 
-  return new Promise((resolve) => {
-    resolve(true);
-  });
+    return Promise.resolve(true);
+  } catch (error) {
+    console.error('Failed to fetch pipelines:', error);
+    return Promise.reject(error);
+  }
 };

Configuration used: CodeRabbit UI
Review profile: CHILL

web/src/components/iam/roles/EditRole.vue (1)

1437-1447: Add error handling to getPipelines function.

While the implementation follows the established pattern and correctly integrates with the existing entity loading system, consider adding error handling for robustness.

Apply this diff to improve error handling:

 const getPipelines = async () => {
-  const pipelines = await pipelineService.getPipelines(
-    store.state.selectedOrganization.identifier
-  );
+  try {
+    const pipelines = await pipelineService.getPipelines(
+      store.state.selectedOrganization.identifier
+    );
 
-  updateResourceEntities("pipeline", ["name"], [...pipelines.data.list]);
+    updateResourceEntities("pipeline", ["name"], [...pipelines.data.list]);
 
-  return new Promise((resolve) => {
-    resolve(true);
-  });
+    return true;
+  } catch (error) {
+    console.error('Failed to fetch pipelines:', error);
+    throw error;
+  }
 };

Configuration used: CodeRabbit UI
Review profile: CHILL

#!/bin/bash
# Description: Check for any remaining instances of the old permission format
# and verify the new format is used consistently.

echo "Checking for old permission format 'pipelines:'"
rg -l 'pipelines:[^/]' || echo "No files contain old format"

echo -e "\nChecking usage of new permission format 'pipeline:'"
rg -l 'pipeline:[^/]'

#!/bin/bash
# Check for permission format usage in Rust files
echo "Checking permission format in Rust files:"
rg -A 2 'pipeline:' src/service/pipeline/

#!/bin/bash
# Check for old permission format 'pipelines:' in the codebase
echo "Checking for old permission format:"
rg -A 2 'pipelines:' src/

# Check for permission validation/checking logic
echo -e "\nChecking permission validation logic:"
rg -A 5 'fn.*permission' src/service/pipeline/