Merged
Conversation
Contributor
WalkthroughThis change introduces first-class support for plugin and gRPC subgraphs across the entire stack, including schema, database, control plane, CLI, router, and studio. It adds new subgraph types, plugin lifecycle management, registry integration, plugin image handling, protobuf schema storage, new CLI commands, and comprehensive test coverage for plugin workflows and feature subgraphs. Changes
Estimated code review effort🎯 5 (Critical) | ⏱️ ~90+ minutes Complexity: cross-cutting, schema and migration changes, new DB tables and enum, protobuf contract changes, new RPCs, significant router plugin lifecycle refactor (OCI image handling), CLI surface additions, and many new/updated tests. Review should include DB migration safety, protobuf compatibility, security checks for image unpacking and JWTs, RBAC and quota enforcement, and integration flows between router, control plane, and CLI. Possibly related PRs
✨ Finishing Touches
🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
…09-router-plugins-with-cosmo-integration
Router image scan passed✅ No security vulnerabilities found in image: |
…09-router-plugins-with-cosmo-integration
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (3)
proto/wg/cosmo/platform/v1/platform.proto (3)
168-168: Make CreateFederatedSubgraphRequest.type optional for presence detection (duplicate)Without
optional, down-level clients are indistinguishable from those explicitly settingSTANDARD(0). This can defeat validation and migration logic.- SubgraphType type = 13; + optional SubgraphType type = 13;
399-401: Make Subgraph.type optional for presence detection (duplicate)Same rationale as creation: without presence, existing clients get coerced to
STANDARD(0) and servers cannot tell unset from explicitly set.- SubgraphType type = 18; + optional SubgraphType type = 18;
1842-1842: Make GraphCompositionSubgraph.subgraphType optional (duplicate)Maintains presence semantics in composition results and prevents defaulting ambiguity.
- SubgraphType subgraphType = 7; + optional SubgraphType subgraphType = 7;
🧹 Nitpick comments (6)
proto/wg/cosmo/platform/v1/platform.proto (6)
39-45: ProtoInput: keep strings (UTF-8) — add brief field docs for clarityAligned with the team decision to keep these as
string. Consider documenting expected contents and formats to aid SDK users.message ProtoInput { - string schema = 1; - string mappings = 2; - string lock = 3; - repeated string platforms = 4; - string version = 5; + // Text contents of the protobuf schema (UTF-8) + string schema = 1; + // Text contents of plugin mappings (UTF-8) + string mappings = 2; + // Text contents of the lock file (UTF-8) + string lock = 3; + // Supported build targets (e.g., "linux/amd64", "linux/arm64", "wasm") + repeated string platforms = 4; + // Plugin version (e.g., semver) + string version = 5; }
67-68: PublishFederatedSubgraphRequest: clarify relation betweentypeandprotoPlease document the precondition so clients know how to populate these fields. Server-side must enforce it.
optional bool disable_resolvability_validation = 12; - optional SubgraphType type = 13; - optional ProtoInput proto = 14; + // If type != STANDARD, 'proto' must be provided; for STANDARD subgraphs, 'proto' must be omitted. + optional SubgraphType type = 13; + optional ProtoInput proto = 14;
370-374: SubgraphType: add short comments per valueNames look good. Add one-line docs to reduce ambiguity across SDKs.
enum SubgraphType { - STANDARD = 0; - GRPC_PLUGIN = 1; - GRPC_SERVICE = 2; + // Standard GraphQL subgraph + STANDARD = 0; + // gRPC plugin running within the router + GRPC_PLUGIN = 1; + // External gRPC service subgraph + GRPC_SERVICE = 2; }
377-381: Subgraph.PluginData: add field docsMirror
ProtoInputdocs so the meaning ofplatformsandversionremains consistent across request/response types.message Subgraph { message PluginData{ - string version = 1; - repeated string platforms = 2; + // Plugin version (e.g., semver) + string version = 1; + // Supported target platforms (e.g., "linux/amd64", "linux/arm64", "wasm") + repeated string platforms = 2; }
3223-3225: Annotate RPC as NO_SIDE_EFFECTSThis RPC validates and fetches metadata; marking as no side effects can improve client behavior and proxies.
- rpc ValidateAndFetchPluginData(ValidateAndFetchPluginDataRequest) returns (ValidateAndFetchPluginDataResponse) {} + rpc ValidateAndFetchPluginData(ValidateAndFetchPluginDataRequest) returns (ValidateAndFetchPluginDataResponse) { + option idempotency_level = NO_SIDE_EFFECTS; + }
2846-2850: ValidateAndFetchPluginDataRequest: confirm call timing & strengthen identityI didn’t find any implementation or call sites for ValidateAndFetchPluginData in the service layer—please verify whether this RPC can be invoked before a subgraph record exists. If it can, adding a unique identifier (for example, a
typeor dedicatedidfield) will help avoid misclassification down-the-line.Please review
proto/wg/cosmo/platform/v1/platform.proto:message ValidateAndFetchPluginDataRequest { string name = 1; string namespace = 2; repeated Label labels = 3; // Optional: include when request may occur pre-subgraph creation optional SubgraphType type = 4; }– If the RPC is always called post-creation, confirm here.
– If pre-creation calls are possible, please add and document the new field.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (3)
connect-go/gen/proto/wg/cosmo/platform/v1/platform.pb.gois excluded by!**/*.pb.go,!**/gen/**router-tests/go.sumis excluded by!**/*.sumrouter/go.sumis excluded by!**/*.sum
📒 Files selected for processing (4)
connect/src/wg/cosmo/platform/v1/platform_pb.ts(12 hunks)proto/wg/cosmo/platform/v1/platform.proto(8 hunks)router-tests/go.mod(6 hunks)router/go.mod(6 hunks)
🚧 Files skipped from review as they are similar to previous changes (3)
- router/go.mod
- router-tests/go.mod
- connect/src/wg/cosmo/platform/v1/platform_pb.ts
🧰 Additional context used
🧠 Learnings (3)
📚 Learning: 2025-08-07T12:05:06.744Z
Learnt from: StarpTech
PR: wundergraph/cosmo#2079
File: proto/wg/cosmo/platform/v1/platform.proto:39-45
Timestamp: 2025-08-07T12:05:06.744Z
Learning: In the Cosmo project, the proto fields for schema, mappings, and lock in ProtoInput are intentionally kept as string types rather than bytes because the team works with text data and wants it to be UTF-8 encoded for readability and text processing purposes.
Applied to files:
proto/wg/cosmo/platform/v1/platform.proto
📚 Learning: 2025-07-21T15:06:36.664Z
Learnt from: SkArchon
PR: wundergraph/cosmo#2067
File: router/pkg/config/config.schema.json:1637-1644
Timestamp: 2025-07-21T15:06:36.664Z
Learning: In the Cosmo router project, when extending JSON schema validation for security-sensitive fields like JWKS secrets, backwards compatibility is maintained by implementing warnings in the Go code rather than hard validation constraints in the schema. This allows existing configurations to continue working while alerting users to potential security issues.
Applied to files:
proto/wg/cosmo/platform/v1/platform.proto
📚 Learning: 2025-07-21T14:46:34.879Z
Learnt from: SkArchon
PR: wundergraph/cosmo#2067
File: router/pkg/authentication/jwks_token_decoder.go:80-106
Timestamp: 2025-07-21T14:46:34.879Z
Learning: In the Cosmo router project, required field validation for JWKS configuration (Secret, Algorithm, KeyId) is handled at the JSON schema level in config.schema.json rather than through runtime validation in the Go code at router/pkg/authentication/jwks_token_decoder.go.
Applied to files:
proto/wg/cosmo/platform/v1/platform.proto
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (17)
- GitHub Check: build-router
- GitHub Check: Analyze (go)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: image_scan (nonroot)
- GitHub Check: integration_test (./events)
- GitHub Check: integration_test (./telemetry)
- GitHub Check: build_push_image
- GitHub Check: integration_test (./. ./fuzzquery ./lifecycle ./modules)
- GitHub Check: image_scan
- GitHub Check: build_push_image (nonroot)
- GitHub Check: build_test
- GitHub Check: build_test
- GitHub Check: build_test
- GitHub Check: build_push_image
- GitHub Check: build_push_image
- GitHub Check: build_test
- GitHub Check: build_test
…09-router-plugins-with-cosmo-integration
JivusAyrus
deleted the
suvij/eng-7509-router-plugins-with-cosmo-integration
branch
5 tasks
This was referenced Aug 25, 2025
5 tasks
This was referenced Oct 22, 2025
This was referenced Nov 14, 2025
Closed
5 tasks
This was referenced Jan 22, 2026
5 tasks
This was referenced Feb 25, 2026
This was referenced Mar 12, 2026
This was referenced Mar 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Improvements
Bug Fixes
Chores
Tests
Checklist
COMPLETES ENG-7682
COMPLETES ENG-7758