fix: abstain when OAuth whitelist is empty

[wwhsaber]

What

Treat an empty OAuth whitelist as unconfigured (abstain) instead of denying access.

Why

In v5.1.0, apps configured with only OAUTH_GROUPS (no OAUTH_WHITELIST) fail with filter is empty and deny all OAuth users. Groups-based access control never gets a chance to allow them.

Closes #1009

Changes

• UserAllowedRule: on utils.ErrFilterEmpty for OAuth whitelist, return EffectAbstain (same pattern as empty users allow list)
• Invalid non-empty filters still deny

Verification

• Configure app with OAuth groups only, no whitelist
• OAuth user in allowed group should be permitted
• Non-empty whitelist still allows/denies by email match

Summary by CodeRabbit

• Bug Fixes
  • Empty OAuth whitelists are now handled correctly without incorrectly denying access.
  • Access evaluation abstains when no OAuth whitelist entries are configured.

[coderabbitai]

📝 Walkthrough

Walkthrough

OAuth whitelist evaluation now treats an empty whitelist as unconfigured, logs the condition, and returns EffectAbstain instead of denying access through invalid-entry handling.

Changes

OAuth access control

Layer / File(s)	Summary
Handle empty OAuth whitelists internal/service/access_controls_rules.go	UserAllowedRule.Evaluate handles utils.ErrFilterEmpty by logging the empty whitelist and returning EffectAbstain.

Estimated code review effort: 2 (Simple) | ~5 minutes

Suggested reviewers: steveiliop56

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the main fix: abstaining when the OAuth whitelist is empty.
Linked Issues check	✅ Passed	The change matches #1009 by treating an empty OAuth whitelist as abstain so OAuth groups can work.
Out of Scope Changes check	✅ Passed	The diff is limited to the OAuth whitelist error path and aligns with the stated bug fix.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

internal/service/access_controls_rules.go (1)

46-50: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Add an OAuth empty-whitelist regression test.

The branch matches the intended EffectAbstain semantics, but add coverage with an OAuth user and a blank whitelist asserting EffectAbstain; ideally include the policy/group composition that confirms an allowed OAuth group can still grant access.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/access_controls_rules.go` around lines 46 - 50, Add a
regression test for the OAuth access-control evaluation covering a user with
OAuth authentication and a blank whitelist, asserting that the result is
EffectAbstain. Include policy/group composition where an allowed OAuth group can
still grant access, and target the test around the rule evaluation symbol that
handles utils.ErrFilterEmpty.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@internal/service/access_controls_rules.go`:
- Around line 46-50: Add a regression test for the OAuth access-control
evaluation covering a user with OAuth authentication and a blank whitelist,
asserting that the result is EffectAbstain. Include policy/group composition
where an allowed OAuth group can still grant access, and target the test around
the rule evaluation symbol that handles utils.ErrFilterEmpty.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 68b679ba-c7d9-4388-a326-0974e58ce8eb

📥 Commits

Reviewing files that changed from the base of the PR and between 84117ce and b1efd1e.

📒 Files selected for processing (1)

• internal/service/access_controls_rules.go

[codecov]

Codecov Report

❌ Patch coverage is 0% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/service/access_controls_rules.go	0.00%	2 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!