chore(cloud-native): adjust resource scope mappings

[iromli]

The changeset adjusts the scope names required by admin-ui.

Closes #2541

Summary by CodeRabbit

• New Features

  • Added automatic resource scope mapping updates during the upgrade process to migrate scope configurations.

• Chores

  • Updated external dependency versions for build consistency across deployment containers.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

This pull request updates Docker image source version pins for the Jans and Flex repositories, and adds a new migration method to automatically update resource scope mappings for the admin UI from deprecated names to new ones.

Changes

Cohort / File(s)	Summary
Docker image version updates docker-admin-ui/Dockerfile, docker-flex-all-in-one/Dockerfile	Updated JANS_SOURCE_VERSION commit hashes in both Dockerfiles to a newer version; also updated FLEX_SOURCE_VERSION in admin-ui Dockerfile. No logic changes.
Admin UI resource scope migration docker-admin-ui/scripts/upgrade.py	Added update_resource_scopes() method to atomically migrate three resource scope mappings (asset-read, asset-write, asset-delete) from old OAuth scope URIs to new short names. Handles both nested and flat JSON representations. Integrated into invoke() workflow after existing client updates.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• feat(flex-linux-setup):update the renamed scopes in adminUIResourceScopeMapping table #2540 — Updates LDIF entries for adminUIResourceScopesMapping scope names; this PR adds the corresponding migration logic to update those mappings in running systems.
• chore: update jans source version #2497 — Modifies JANS_SOURCE_VERSION in the same Dockerfiles (different target commits).
• chore(cloud-native): add admin-ui and cedarling integration in OCI image #2429 — Updates both JANS_SOURCE_VERSION and FLEX_SOURCE_VERSION in docker-admin-ui/Dockerfile source pins.

Suggested labels

comp-admin-ui

Suggested reviewers

• moabu
• devrimyatar

Poem

🐰 A rabbit hops through scopes with glee,
From OAuth URIs, now set free,
New names shine bright: asset, not asset-read,
With Docker versions fresh instead,
Migration paths paved, all clear to see! 🎉

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change of adjusting resource scope mappings, which is the primary objective and directly related to the changeset.
Linked Issues check	✅ Passed	The PR implements scope name adjustments in the upgrade.py script and updates source versions, addressing the resource scope mapping changes referenced in issue #2541.
Out of Scope Changes check	✅ Passed	All changes are scoped to resource scope mappings (upgrade.py), Dockerfile version pins (docker-admin-ui and docker-flex-all-in-one), and directly support the linked issue objective.

✨ Finishing touches

• 📝 Generate docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 4

📜 Review details

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between ece094b and 000312e.

📒 Files selected for processing (3)

• docker-admin-ui/Dockerfile
• docker-admin-ui/scripts/upgrade.py
• docker-flex-all-in-one/Dockerfile

🧰 Additional context used

🪛 GitHub Actions: Scan Image

docker-flex-all-in-one/Dockerfile

[warning] 117-117: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CN_AUTH_JAVA_OPTIONS")

---

[warning] 117-117: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CN_AUTH_JETTY_HOST")

---

[warning] 117-117: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CN_AUTH_JETTY_PORT")

---

[warning] 117-117: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CN_SHARE_AUTH_CONF")

---

[warning] 117-117: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CN_SQL_PASSWORD_FILE")

---

[warning] 117-117: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CN_SAML_KC_ADMIN_CREDENTIALS_FILE")

---

[warning] 117-117: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CN_SAML_KC_DB_PASSWORD_FILE")

docker-admin-ui/Dockerfile

[warning] 117-117: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CN_AUTH_JAVA_OPTIONS")

---

[warning] 117-117: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CN_AUTH_JETTY_HOST")

---

[warning] 117-117: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CN_AUTH_JETTY_PORT")

---

[warning] 117-117: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CN_SHARE_AUTH_CONF")

---

[warning] 117-117: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CN_SQL_PASSWORD_FILE")

---

[warning] 117-117: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CN_SAML_KC_ADMIN_CREDENTIALS_FILE")

---

[warning] 117-117: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CN_SAML_KC_DB_PASSWORD_FILE")

🪛 Ruff (0.14.10)

docker-admin-ui/scripts/upgrade.py

242-242: Missing return type annotation for private function update_scope

Add return type annotation: None

(ANN202)

🔇 Additional comments (1)

docker-admin-ui/scripts/upgrade.py (1)

57-57: LGTM!

The method invocation is appropriately placed in the upgrade flow, ensuring resource scope mappings are updated after client configurations.

[sonarqubecloud]

Quality Gate passed for 'Gluu Admin UI'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud