chore(server): remove the resources_config_path boot loader flow

[rohilsurana]

Status

The deprecation window has elapsed. resources_config_path was deprecated at v0.110.0 for two minor versions, and frontier is now at v0.114.0, so the removal is due. This stays a draft on the deployment gate below: it should land only once every deployment has cut over to the reconcile flow.

What

Removes the app.resources_config_path boot loader end to end. Custom permissions and role overrides are now managed through the reconcile flow (the Permission and Role kinds), so the server no longer reads a resource config file at startup.

• cmd/serve.go: drop the resource blob load and the SchemaConfigRepository wiring.
• internal/bootstrap: drop the FileService (schemaConfig) dependency. MigrateSchema now re-applies the base schema merged with the permissions already in the DB (via AppendSchema, which preserves them) instead of reading a config file. MigrateRoles no longer creates config-defined custom roles, since reconcile owns them. BuiltinPermissions (the permission delete-guard) reports only base-schema permissions.
• pkg/server/config.go: remove the resources_config_path and resources_config_path_secret fields.
• internal/store/blob/schema_repository.go: removed, no longer used.
• config/sample.config.yaml: drop the sample entries.
• test/e2e: the regression and smoke suites seed custom compute resources through the admin API instead of a resource config file. The shared setup lives in testbench/helper.go.

Why it is safe

Existing custom permissions survive across boots because they live in the database, and AppendSchema merges them back into the schema. Existing role overrides survive because MigrateRoles is skip-if-exists. So on a server that has already migrated, this is a no-op. On one that has not, it stops seeding from the config, which is why the cutover gate matters.

Gating

• This is a breaking change for users still on resources_config_path, so removal waits out the two-minor-version deprecation window. That window is now over: deprecated at v0.110.0, past the v0.112.0 removal target, current release v0.114.0.
• A deployment must run the reconcile flow first, so roles and permissions are owned there, and must drop resources_config_path from its own config before taking this build.

Verification

Rebased onto current main (70 commits ahead of the old base) with no conflicts. go build ./..., go vet, and unit tests for internal/bootstrap, pkg/server, and core/resource pass. gofmt and vet clean.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview	Aug 11, 2026 10:11am

[coderabbitai]

Warning

Review limit reached

@rohilsurana, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 7 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c2860087-9ba1-4b0e-b0fc-a36068407a45

📥 Commits

Reviewing files that changed from the base of the PR and between 1f4e1a2 and b74cbdb.

📒 Files selected for processing (8)

• docs/content/docs/authz/custom-resources.mdx
• docs/content/docs/configurations.mdx
• docs/content/docs/reference/configurations.mdx
• internal/store/blob/testdata/compute.yml
• internal/store/blob/testdata/database.yml
• test/e2e/regression/api_test.go
• test/e2e/regression/onboarding_test.go
• test/e2e/testbench/helper.go

📝 Walkthrough

Summary by CodeRabbit

• Breaking Changes

  • Removed support for the deprecated resource configuration settings.
  • Resource permissions and custom roles are no longer loaded from configuration files during startup.

• Behavior Updates

  • Custom roles and permissions can be managed through the administration API.
  • Built-in permissions continue to be restored automatically when the service starts.
  • Permission deletion messaging now reflects the updated restoration behavior.

• Configuration

  • Removed deprecated resource configuration entries from the sample configuration.

Walkthrough

The server no longer loads deprecated resource configuration at boot. Bootstrap uses only the base schema and database-backed permissions. End-to-end tests seed custom compute permissions and roles through the admin API.

Changes

Resource configuration removal

Layer / File(s)	Summary
Remove resource configuration wiring cmd/serve.go	Server startup no longer creates the resource blob or schema repository.
Use base-schema bootstrap migration internal/bootstrap/service.go, internal/api/v1beta1connect/permission.go	Bootstrap removes configuration-based schema and role migration. Built-in permission messages now refer to the base schema.
Seed test resources through the admin API test/e2e/regression/..., test/e2e/smoke/..., test/e2e/testbench/helper.go	Tests remove fixture configuration and create compute permissions and roles with SeedComputeResources.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• raystack/frontier#1720: Both changes modify server startup and bootstrap dependency wiring.
• raystack/frontier#1766: Both changes remove deprecated resource configuration infrastructure and boot-time schema loading.

Suggested reviewers: whoabhisheksah

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 31481063487

Coverage decreased (-0.02%) to 48.082%

Details

• Coverage decreased (-0.02%) from the base build.
• Patch coverage: 7 uncovered changes across 3 files (0 of 7 lines covered, 0.0%).
• 17 coverage regressions across 3 files.

Uncovered Changes

File	Changed	Covered	%
internal/bootstrap/service.go	5	0	0.0%
cmd/serve.go	1	0	0.0%
internal/api/v1beta1connect/permission.go	1	0	0.0%

Coverage Regressions

17 previously-covered lines in 3 files lost coverage.

File	Lines Losing Coverage	Coverage
internal/store/blob/blob.go	15	0.0%
cmd/serve.go	1	0.0%
internal/bootstrap/service.go	1	22.51%

---

Coverage Stats

Relevant Lines:	39861
Covered Lines:	19166
Line Coverage:	48.08%
Coverage Strength:	15.39 hits per line

---

💛 - Coveralls

[rohilsurana]

Automated code review (xhigh). Findings below, most important first. Two are behavior questions worth confirming before merge; the rest are cleanups.

[rohilsurana]

Removing the loader and its deprecation warning together leaves upgraders with no signal.

An operator who still sets resources_config_path on upgrade gets nothing. The key becomes an unknown field that config loading ignores without error, and the old logger.Warn deprecation notice is gone. Any new custom permission or role in that file is never registered, so CheckPermission and CreatePolicy for those resources fail until they reseed through the admin/reconcile API. The docs (configurations.mdx, custom-resources.mdx) still describe this field. Consider keeping a boot-time warning for one release and updating those docs.

[rohilsurana]

Docs updated in 85ed587 (removed resources_config_path from the config docs and added a banner to custom-resources.mdx; a full rewrite is coming in a separate PR). The boot-time deprecation warning is intentionally removed: reconcile and the admin API own custom permissions and roles now, and this PR is gated on a deployment running reconcile first. Leaving this open for a call on whether a one-release warning is still wanted.

[rohilsurana]

Config-defined permissions lose delete protection.

BuiltinPermissions now covers only the base schema. A permission that used to come from the config file (say compute/order:create) is no longer in the builtin set, so DeletePermission accepts it where it used to reject with FailedPrecondition. That removes the permission and its SpiceDB tuples, and boot no longer recreates it. Every role and policy referencing it silently loses the grant. Please confirm this dropped protection is intended.

[rohilsurana]

Intended. Under the reconcile model custom permissions are owned by reconcile and the admin API, so config no longer contributes to the builtin set and such a permission becomes deletable. This PR is gated on reconcile owning that state first.

[rohilsurana]

Config-defined roles are no longer self-healed at boot.

Predefined roles are still recreated by migrateRole, but the loop that recreated config-defined roles is gone. So a deleted custom role now stays deleted for good, and anything bound to it loses access with no boot-time recovery. Confirm this is expected now that reconcile is the seeding path.

(anchored near the diff; refers to internal/bootstrap/service.go:249)

[rohilsurana]

Intended, same reasoning as the permission delete-guard: reconcile is the seeding path now, so config-defined roles are no longer recreated at boot. Predefined roles are still self-healed by migrateRole.