Fix predefined-role permission escalation

[yashed]

Purpose

AddRolePermissions/RemoveRolePermissions let a caller holding only role:update modify a predefined system role's permission set (e.g. rewrite "Agent Manager Admin"), even though UpdateRole/DeleteRole already blocked touching predefined roles. Separately, the bootstrap-seeded default roles were never recognized as predefined at all, so this gap applied to real default roles in every deployment.

• Resolves : [Bug]: Predefined role permissions can be modified via API #1598

Goals

• Block permission changes on predefined roles for every caller, same as rename/delete.
• Fix the default role names so they're actually recognized as predefined.
• Keep role-membership management (assigning/removing users) unrestricted, since that's intentional and unrelated to this bug.

Approach

• Added the existing validatePredefinedRole check to AddRolePermissions and RemoveRolePermissions in controllers/identity_controller.go, right after the ownership check, mirroring UpdateRole/DeleteRole exactly.
• Left AddRoleAssignees/RemoveRoleAssignees untouched, no predefined-role check added there.
• Fixed amp-thunder-bootstrap.yaml: the four default roles were seeded as admin, developer, ai-lead, platform-engineer, which don't match constants.IsPredefinedRole's expected strings. Renamed to Agent Manager Admin, Developer, AI Lead, Platform Engineer, keeping the stable id fields unchanged.
• No new permission or endpoint added, reused the existing guard function as-is.

User stories

As an org admin, a predefined role's permission set can't be changed by anyone through the API, mine included, so its meaning stays fixed and predictable. As a delegated user with only role:update, I can still manage custom roles and assign people to any role, but I can no longer silently expand what a predefined role like "Agent Manager Admin" grants.

Release note

N/A

Documentation

N/A

Training

N/A

Certification

N/A

Marketing

N/A

Automation tests

• Unit tests
  identity_controller_test.go: TestAddRolePermissions_PredefinedRoleRejected / TestRemoveRolePermissions_PredefinedRoleRejected confirm a predefined role's permissions can't be changed (400). TestAddRolePermissions_CustomRoleAllowed / TestRemoveRolePermissions_CustomRoleAllowed confirm custom roles are unaffected. TestAddRoleAssignees_PredefinedRoleAllowed / TestRemoveRoleAssignees_PredefinedRoleAllowed pin that assigning users to a predefined role still works. go build, go vet, and the full unit suite all pass.
• Integration tests
  None added.

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes
• Ran FindSecurityBugs plugin and verified report? no
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes

Samples

N/A

Related PRs

N/A

Migrations (if applicable)

N/A

Test environment

macOS (Darwin), local Docker-based agent-manager-service and Thunder instance, Go 1.25.

Learning

N/A

Summary by CodeRabbit

• Bug Fixes

  • Prevented permission changes to predefined roles and returned the standard validation error.
  • Custom roles continue to support permission changes.
  • Role assignee updates remain available for both predefined and custom roles.

• Improvements

  • Updated display names for built-in roles:
    • Agent Manager Admin
    • Developer
    • AI Lead
    • Platform Engineer

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a9b5e900-3f63-471f-b6d2-8db5bee47231

📥 Commits

Reviewing files that changed from the base of the PR and between 667653d and e639b25.

📒 Files selected for processing (3)

• agent-manager-service/controllers/identity_controller.go
• agent-manager-service/controllers/identity_controller_test.go
• deployments/helm-charts/wso2-amp-thunder-extension/templates/amp-thunder-bootstrap.yaml

---

📝 Walkthrough

Walkthrough

Predefined roles now reject permission additions and removals. Custom roles continue to allow permission changes. Assignee changes remain allowed for both role types. Four AMP role display names were updated.

Changes

Role permission authorization

Layer / File(s)	Summary
Permission mutation guard agent-manager-service/controllers/identity_controller.go	AddRolePermissions and RemoveRolePermissions reject predefined roles before request processing and audit recording.
Authorization regression coverage agent-manager-service/controllers/identity_controller_test.go	Tests verify predefined-role rejection, custom-role success, and allowed assignee changes for both role types.

AMP role display names

Layer / File(s)	Summary
AMP role display-name updates deployments/helm-charts/wso2-amp-thunder-extension/templates/amp-thunder-bootstrap.yaml	The display names for admin, developer, AI lead, and platform engineer roles were updated. Their identifiers and permissions remain unchanged.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to e639b

The PR blocks unauthorized permission changes to predefined roles and corrects default-role recognition while preserving intended membership management; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: menakaj

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary change: preventing permission escalation through predefined roles.
Description check	✅ Passed	The description covers the required sections, explains the fix, links the issue, and documents tests, security checks, and test environment.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}