test: add e2e tests for PAT CRUD lifecycle and role-scope matrix

[AmanGIT07]

Summary

• Add TestPATCRUD_Lifecycle — full sequential e2e test covering all 8 PAT RPCs: ListRolesForPAT, CheckTitle, Create, Get, Search, Update, Regenerate, Delete
• Add TestPATScope_RoleMatrix — table-driven test covering 9 org/project role combinations
• Add TestPATScope_DeniedRole — verifies org_owner rejection with denied permissions config
• Add TestPATCRUD_CreateErrors — duplicate title, denied role, past expiry
• Replace TestPATScope_OrgOwner with TestPATScope_OrgManager (org_owner is now a denied role)
• Add DeniedPermissions: ["app_organization_administer"] to test config (matches production)

CRUD Lifecycle flow

1. ListRolesForPAT — returns roles, excludes denied org_owner
2. CheckTitle — available
3. Create with org_viewer + project_viewer(proj1) — token returned, scopes verified, used_at/regenerated_at nil
4. CheckTitle — now taken
5. Get — fields verified, no token
6. Search — PAT found in list
7. Use token → permission check → verify used_at set
8. Verify permissions before update — org:get ✓, proj1:get ✓
9. Update — narrow to org_viewer only
10. Verify permissions after update — org:get ✓, proj1:get ✗
11. Regenerate — new token works, old token rejected, regenerated_at set
12. Delete → get returns NotFound, deleted token rejected

Role-scope matrix (9 combinations)

Org Role	Project Role	Scope	Key assertions
viewer	—	—	org:get ✓, proj:get ✗
manager	—	—	org:update ✓, proj:get ✓ (inherited), proj:delete ✗
viewer	viewer	specific	proj1:get ✓, proj2:get ✗
viewer	manager	specific	proj1:update ✓, proj1:delete ✗
viewer	owner	specific	proj1:delete ✓, proj2:get ✗
viewer	viewer	all	proj1:get ✓, proj2:get ✓
viewer	owner	all	proj1:delete ✓, proj2:delete ✓
billing_mgr	—	—	billing ✓, org:get ✗, proj:get ✗
manager	viewer	specific	org:update ✓, proj1:update ✓ (inherited), proj2:get ✓ (inherited)

Test plan

• go build ./test/e2e/... passes
• All PAT e2e tests pass
• All other regression suites unaffected

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview, Comment	Apr 21, 2026 6:34am

[coderabbitai]

Warning

Rate limit exceeded

@AmanGIT07 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 51 minutes and 19 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 51 minutes and 19 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4f9ffbb0-75de-49b0-9442-e3bdd3791219

📥 Commits

Reviewing files that changed from the base of the PR and between d8c6bbb and ed03449.

📒 Files selected for processing (1)

• test/e2e/regression/pat_test.go

📝 Walkthrough

Walkthrough

This PR modifies the PAT e2e regression test suite to enable race build execution, expand test coverage with four new test functions covering denied roles, role/scope matrix combinations, PAT lifecycle, and create error cases, while also renaming an existing test from org owner to org manager scope.

Changes

Cohort / File(s)	Summary
Build Constraint and Imports test/e2e/regression/pat_test.go	Removed //go:build !race constraint to allow race build execution and added fmt import for test string formatting.
PAT Configuration Updates test/e2e/regression/pat_test.go	Updated PAT configuration in SetupSuite to deny "app_organization_administer" permission via userpat.Config.DeniedPermissions.
Existing Test Modifications test/e2e/regression/pat_test.go	Renamed TestPATScope_OrgOwner to TestPATScope_OrgManager and changed PAT role from schema.RoleOrganizationOwner to schema.RoleOrganizationManager.
New Test Coverage test/e2e/regression/pat_test.go	Added TestPATScope_DeniedRole (validates denied role rejection), TestPATScope_RoleMatrix (org/project scope combinations and inherited permissions), TestPATCRUD_Lifecycle (token auth, scope narrowing, regenerate/delete workflows), and TestPATCRUD_CreateErrors (duplicate title, denied role, past expiry).

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

• feat: add PAT identity to JWT claims  #1509 — New PAT e2e tests exercise token authentication and JWT subtype changes introduced in this PR, directly depending on PAT GetByID and JWT handling.
• refactor: restructure PAT scopes to use role-resource type pairing #1475 — PAT scopes refactor also modified this test file; new test renames and scope matrix directly relate to scoped PAT changes.

Suggested reviewers

• rohilsurana
• whoAbhishekSah

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7ef9ae0d-41bb-4915-b5aa-3e3adf59992d

📥 Commits

Reviewing files that changed from the base of the PR and between 901863f and d8c6bbb.

📒 Files selected for processing (1)

• test/e2e/regression/pat_test.go

[coveralls]

Coverage Report for CI Build 24707799176

Warning

Build has drifted: This PR's base is out of sync with its target branch, so coverage data may include unrelated changes.
Quick fix: rebase this PR. Learn more →

Coverage remained the same at 42.192%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	36879
Covered Lines:	15560
Line Coverage:	42.19%
Coverage Strength:	11.9 hits per line

---

💛 - Coveralls