feat: switch RAG service to connect_as credentials

[tsivaprasad]

Summary

This PR switch the RAG service from auto-generated ServiceUserRole credentials to
connect_as credentials sourced from database_users. connect_as is now required when provisioning a
RAG service.

Changes

• Validation: connect_as is now required for RAG service specs;
  API returns 400 if omitted or if the referenced user is not in
  database_users
• Removed legacy ServiceUserRole path for RAG: no auto-generated Postgres
  roles are created; generateRAGInstanceResources no longer emits
  ServiceUserRole resources
• RAGConfigResource: always uses ConnectAsUsername/ConnectAsPassword
  from the spec; removed ServiceUserRole dependency and legacy credential
  lookup from writeConfigFile
• ServiceInstanceSpecResource / ServiceInstanceResource: RAG no longer
  depends on ServiceUserRole;
• RAGPreflightResource: added PostgresDatabaseResourceIdentifier as a
  dependency so the preflight runs after the database is created.
• E2E tests: all RAG fixtures updated to include a rag_user in
  database_users and connect_as: "rag_user" on the service spec

Testing

Verification:

1. Created a cluster
2. Created database with RAG service using connect_as: "app_read_only"
   rag_create_db_connect_as.json

ID             NAME                          MODE         REPLICAS   IMAGE
gcmqn1rgtdyl   rag-storefront-rag-689qacsi   replicated   1/1        ghcr.io/pgedge/rag-server:latest

3. Verified config file contains connect_as credentials
   pgedge-rag-server.yaml

4. Verified API returns 400 when connect_as is omitted from a RAG service spec

5. Verified API returns 400 when connect_as references a user not in database_users

Checklist

• Tests added & updated

PLAT-552

[coderabbitai]

Warning

Rate limit exceeded

@tsivaprasad has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 27 minutes and 39 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 27 minutes and 39 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3c98d879-a4ca-4ea0-9495-88c065a61c81

📥 Commits

Reviewing files that changed from the base of the PR and between 6cb9bc5 and ee4f18c.

📒 Files selected for processing (3)

• server/internal/orchestrator/swarm/rag_preflight_resource.go
• server/internal/orchestrator/swarm/service_instance.go
• server/internal/orchestrator/swarm/service_instance_spec.go

📝 Walkthrough

Walkthrough

The changes implement a new authentication model for RAG services by introducing a preflight resource validation step and passing explicit connect-as credentials through the orchestration pipeline instead of relying on ServiceUserRole resources.

Changes

Cohort / File(s)	Summary
RAG Preflight Resource (New) server/internal/orchestrator/swarm/rag_preflight_resource.go, server/internal/orchestrator/swarm/rag_preflight_resource_test.go	Introduces new RAGPreflightResource that validates database role existence before RAG startup, implementing Refresh, Create, Update, and Delete methods with role verification logic.
RAG Config Resource server/internal/orchestrator/swarm/rag_config_resource.go, server/internal/orchestrator/swarm/rag_config_resource_test.go	Adds ConnectAsUsername and ConnectAsPassword fields; bumps schema version to "2"; removes ServiceUserRole dependency and replaces it with RAGPreflight dependency; updates credential sourcing to use struct fields directly instead of context lookup.
RAG Orchestration server/internal/orchestrator/swarm/orchestrator.go, server/internal/orchestrator/swarm/rag_instance_resources_test.go	Refactors RAG instance resource generation to include RAGPreflight resource in dependency chain; removes ServiceUserRole resource creation; passes ConnectAsUsername and ConnectAsPassword to config and service instance resources.
Service Instance Updates server/internal/orchestrator/swarm/service_instance.go, server/internal/orchestrator/swarm/service_instance_spec.go	Adds ConnectAsUsername field to ServiceInstanceResource; limits ServiceUserRole dependencies to only postgrest services; extends mcp/rag credential bypass to eliminate service user role lookups.
Validation and Registry server/internal/orchestrator/swarm/validate.go, server/internal/orchestrator/swarm/resources.go	Updates validation to require ConnectAs for both MCP and RAG services; registers RAGPreflightResource in resource type registry.
End-to-End Tests e2e/rag_service_test.go	Adds rag_user database user with ConnectAs field across all RAG service test cases including provisioning, pipeline queries, multi-host, and unsupported-version scenarios.

Poem

🐰 RAG hops through the preflight gate,
No roles delay the database state,
Credentials flow like morning dew,
Validation checks before we're through,
Authentication fresh and bright! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: switching RAG service credential mechanism from auto-generated roles to connect_as credentials, which is the primary objective of this PR.
Description check	✅ Passed	The description covers all required sections: Summary, Changes, Testing, and Checklist. It provides clear detail on what changed, links to the relevant ticket (PLAT-552), and includes verification steps and test confirmation.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch PLAT-552-rag-switch-from-service-user-role-to-connect-as-credentials

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 17 complexity · 0 duplication

Metric	Results
Complexity	17
Duplication	0

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

server/internal/orchestrator/swarm/rag_preflight_resource.go (1)

84-110: Consider adding a timeout for database operations.

The validate function performs database connectivity and role existence checks without an explicit timeout. If the database is slow to respond or the connection hangs, this could block indefinitely.

The ServiceUserRole.Refresh method (in service_user_role.go) uses a 30-second timeout for similar database operations:

ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
defer cancel()

Consider applying the same pattern here for consistency and reliability.

♻️ Proposed fix to add timeout

+import "time"
+
 func (r *RAGPreflightResource) validate(ctx context.Context, rc *resource.Context) error {
+	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+
 	primary, err := database.GetPrimaryInstance(ctx, rc, r.NodeName)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@server/internal/orchestrator/swarm/rag_preflight_resource.go` around lines 84
- 110, The validate function may block on DB ops; wrap the incoming ctx with a
timeout (e.g., 30s) using ctx, cancel := context.WithTimeout(ctx,
30*time.Second) and defer cancel(), then use that timed ctx for the calls in
RAGPreflightResource.validate (notably primary.Connection(ctx, rc,
r.DatabaseName), conn.QueryRow(ctx, ...).Scan(&exists) and conn.Close(ctx)) so
all database operations honor the timeout and get cancelled consistently; ensure
the cancel() is deferred immediately after creating the timed context.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@server/internal/orchestrator/swarm/service_instance_spec.go`:
- Around line 97-101: The early-return for RAG/MCP in the method handling
ServiceInstanceSpecResource leaves legacy credentials intact; before returning
when s.ServiceSpec.ServiceType == "mcp" || "rag", explicitly clear the legacy
field by setting ServiceInstanceSpecResource.Credentials to nil (or empty) so
RAG records cannot carry stale creds forward—locate the block that checks
s.ServiceSpec.ServiceType and add the credentials reset (s.Credentials = nil)
immediately before the return.

In `@server/internal/orchestrator/swarm/service_instance.go`:
- Around line 35-38: The new ServiceInstance field ConnectAsUsername is never
populated from persisted/deserialized state so it stays empty and causes
spurious diffs; update the Refresh method on ServiceInstance to set
s.ConnectAsUsername = desired.ServiceSpec.ConnectAs (or the appropriate path to
the desired spec's connect_as value) when loading the desired state so the
persisted field is synchronized, or alternatively add "ConnectAsUsername" to
DiffIgnore if it is purely informational.

---

Nitpick comments:
In `@server/internal/orchestrator/swarm/rag_preflight_resource.go`:
- Around line 84-110: The validate function may block on DB ops; wrap the
incoming ctx with a timeout (e.g., 30s) using ctx, cancel :=
context.WithTimeout(ctx, 30*time.Second) and defer cancel(), then use that timed
ctx for the calls in RAGPreflightResource.validate (notably
primary.Connection(ctx, rc, r.DatabaseName), conn.QueryRow(ctx,
...).Scan(&exists) and conn.Close(ctx)) so all database operations honor the
timeout and get cancelled consistently; ensure the cancel() is deferred
immediately after creating the timed context.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 53a1b24e-8953-4f1b-9a0a-149bab32ef1e

📥 Commits

Reviewing files that changed from the base of the PR and between 628ae6a and 6cb9bc5.

📒 Files selected for processing (11)

• e2e/rag_service_test.go
• server/internal/api/apiv1/validate.go
• server/internal/orchestrator/swarm/orchestrator.go
• server/internal/orchestrator/swarm/rag_config_resource.go
• server/internal/orchestrator/swarm/rag_config_resource_test.go
• server/internal/orchestrator/swarm/rag_instance_resources_test.go
• server/internal/orchestrator/swarm/rag_preflight_resource.go
• server/internal/orchestrator/swarm/rag_preflight_resource_test.go
• server/internal/orchestrator/swarm/resources.go
• server/internal/orchestrator/swarm/service_instance.go
• server/internal/orchestrator/swarm/service_instance_spec.go

[rshoemaker]

Looks good!