tests/streams/roles/permission_gates_test.go (2)

44-46: Add an assertion that the data provider was auto-created.

Right after setupSystemRoles, assert the data_providers row exists for authorizedWriter to prove the new side effect works end-to-end.

Example (add after Line 46):

// Verify DP auto-created for the granted writer
require.NoError(t, setup.RequireDataProviderExists(ctx, platform, authorizedWriter))

If setup.RequireDataProviderExists doesn't exist, I can add a tiny helper that queries data_providers and fails if missing.

---

44-46: Add negative test for invalid wallet on grant.

Granting network_writer to an invalid address should error (helper_create_data_providers validates). Add a test to lock this behavior.

Sketch:

t.Run("grant fails for invalid wallet address", func(t *testing.T) {
  bad := "0xnotanaddress"
  err := procedure.GrantRoles(ctx, procedure.GrantRolesInput{
    Platform: managerPlatform, Owner: "system", RoleName: "network_writer", Wallets: []string{bad},
  })
  require.Error(t, err)
})

internal/migrations/013-role-actions.sql (4)

7-10: Clarify docstring to reflect intended scope.

State explicitly that it’s invoked only for system:network_writer grants (post-fix above).

Apply:

- * Used by grant_roles when auto-creating data providers during network_writer role assignment.
+ * Used by grant_roles when auto-creating data providers during system:network_writer role assignment.

---

19-27: Optional: be explicit about conflict target and add DISTINCT.

Small robustness improvement and fewer no-op attempts when the input has duplicates.

Apply (if your dialect supports it):

-    FROM UNNEST($addresses) AS t(address)
-    ON CONFLICT DO NOTHING;
+    FROM UNNEST($addresses) AS t(address)
+    ON CONFLICT (address) DO NOTHING;

---

149-151: Lifecycle note: keep-or-remove data_providers on revoke?

Revoke doesn’t touch data_providers, which is fine if providers are durable identities. If the intention is tighter coupling, consider documenting this or adding a cleanup action.

Would you like a follow-up migration/action pair to deactivate (not delete) providers when the role is revoked?

---

11-27: Add a guard for empty/NULL addresses arrays.

Grant already no-ops on empty arrays; mirror that here to avoid a pointless INSERT SELECT.

Apply:

 CREATE OR REPLACE ACTION helper_create_data_providers($addresses TEXT[]) PRIVATE {
+    IF array_length($addresses) = 0 {
+        RETURN;
+    }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

internal/migrations/013-role-actions.sql (1)

152-154: Scope auto-creation to system:network_writer only.

Current code provisions providers for any role grant, exceeding the PR intent and surprising other workflows.

Apply:

-    -- Auto-create data providers when granting network_writer role
-    helper_create_data_providers($wallets);
+    -- Auto-create data providers only for system:network_writer grants
+    IF $owner = 'system' AND $role_name = 'network_writer' {
+        helper_create_data_providers($wallets);
+    }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.