fix(auth): run generic entity E2E tests as a service principal

[anastasia-nesterenko]

Summary

Updates the direct Entities API E2E tests to authenticate as an internal service principal, matching how feature services access the entity store in production.

This is a test-only behavior correction. It does not change runtime authorization: generic Entities API CRUD remains service-only, and authenticated user principals continue to receive 403 Forbidden.

Changes

• Adds a module-scoped entity_store_sdk fixture using as_service_for.
• Uses the service-authenticated SDK for entity CRUD, listing, filtering, sorting, renaming, and cleanup.
• Keeps user-facing project operations on the existing caller SDK.
• Uses the SDK's absolute base URL for the /cluster-info E2E request.
• Clarifies the existing Rego comments describing workspace sub-resource authorization. No Rego rule or permission behavior changes.

Why

These E2E tests were calling the internal generic Entities API with user credentials. Because that API is intentionally service-only, the calls correctly returned 403.

Feature services access the entity store using a service:* principal. The tests now use the same authentication model so they validate entity-store behavior without weakening access controls.

Runtime impact

None. This PR does not change authorization policies, role definitions, or endpoint behavior.

Validation

To rerun on the final PR head:

• uv run --frozen pytest e2e/test_entities.py -v --run-e2e
• uv run --frozen ruff check e2e/test_entities.py
• git diff --check

Summary by CodeRabbit

• Tests
  • Updated entity end-to-end coverage to validate internal entity-store CRUD and related flows using service credentials, including project association checks and search/sort/rename scenarios.
  • Improved the cluster information E2E test to build requests from the configured base URL with trailing-slash normalization.
• Documentation
  • Clarified authorization behavior for workspace sub-resources, explaining how permission-based checks apply without changing effective access controls.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 53e1cc48-9b9a-4ca7-9c62-0e9d576f82f6

📥 Commits

Reviewing files that changed from the base of the PR and between 764ac00 and 7b0d4b4.

📒 Files selected for processing (2)

• e2e/test_entities.py
• services/core/auth/src/nmp/core/auth/app/policies/authz.rego

🚧 Files skipped from review as they are similar to previous changes (2)

• services/core/auth/src/nmp/core/auth/app/policies/authz.rego
• e2e/test_entities.py

---

📝 Walkthrough

Walkthrough

Entity E2E tests now authenticate entity-store operations with a service-principal client while retaining caller credentials for projects. The cluster-info URL uses the SDK base URL, and authorization comments clarify workspace sub-resource handling.

Changes

Internal entities E2E coverage

Layer / File(s)	Summary
Internal entity client setup e2e/test_entities.py, services/core/auth/.../authz.rego	Adds the internal SDK fixture, normalizes the cluster-info URL, and clarifies authorization comments.
CRUD and project association e2e/test_entities.py	Routes entity lifecycle and project-association operations through the internal client while retaining caller credentials for projects.
Listing, sorting, and filtering e2e/test_entities.py	Routes entity listing, sorting, search, filtering, and cleanup through the internal client.
Rename and generated-name flows e2e/test_entities.py	Routes rename and auto-generated-name coverage through the internal client, including retrieval and cleanup assertions.

Suggested labels: test

Suggested reviewers: ironcommit, mckornfield

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: entity E2E tests now run with a service principal.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch anesterenko/aircore-771-entity-rbac-returns-403-for-authenticated-users-on-nmpdev

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	27149/34858	77.9%	62.2%
Integration Tests	15966/33570	47.6%	20.0%

[mckornfield]

is the fix just a test only fix, specifically using a different principal sdk?

[ironcommit]

Need some clarification on what is changing in the PR

[ironcommit]

LGTM