Nonadmin only

[weshayutin]

Why the changes were made

fixes: #128

How to test the changes made

oc oadp client config set nonadmin=true

• now the user should only have access to: client, help and nonadmin :)

nacuser1@fedora:~/git/oadp-cli$ oc oadp --help
OADP CLI commands

Usage:
  oc oadp [flags]
  oc oadp [command]

Available Commands:
  client            Velero client related commands
  help              Help about any command
  nonadmin          Work with non-admin resources

Flags:
      --add_dir_header                   If true, adds the file directory to the header of the log messages
      --alsologtostderr                  log to standard error as well as files (no effect when -logtostderr=true)
  -h, --help                             help for oadp
      --kubeconfig string                Path to the kubeconfig file to use to talk to the Kubernetes apiserver. If unset, try the environment variable KUBECONFIG, as well as in-cluster configuration
      --kubecontext string               The context to use to talk to the Kubernetes apiserver. If unset defaults to whatever your current-co

Summary by CodeRabbit

• New Features
  • Added Velero Phase column to non-admin Backup Storage Location table for improved status visibility.
  • Implemented non-admin mode configuration support that selectively hides admin commands at runtime.
  • Client configuration extended to detect and manage non-admin mode from flexible value types.
  • Non-admin behavior now respects configured namespace handling to use the active kubeconfig namespace.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds non-admin mode detection and runtime behavior to the Velero CLI (hide admin commands and remove namespace override) and extends non-admin BSL get output with a "VELERO PHASE" column derived from the NABSL status.

Changes

Cohort / File(s)	Summary
Root command & non-admin wiring cmd/root.go	Adds isNonadminEnabled(config) helper, switches delete import to veldelete alias and veldelete.NewCommand(f), removes namespace override when nonadmin is enabled, and hides admin commands at runtime leaving only nonadmin, client, and completion.
Client config / factories cmd/shared/factories.go	Adds NonAdmin interface{} field to ClientConfig and new IsNonAdmin() bool method supporting boolean and string forms (case-insensitive).
Non-admin BSL table output cmd/non-admin/bsl/get.go	Adds "VELERO PHASE" header and per-item derivation via new getBSLVeleroPhase(*nacv1alpha1.NonAdminBackupStorageLocation) string, defaulting to "N/A" when status is unavailable.

Sequence Diagram(s)

sequenceDiagram
    actor User
    participant RootCmd as Root Command
    participant Config as VeleroConfig
    participant Factories as Client Factories
    participant CmdMgr as Command Manager

    User->>RootCmd: invoke CLI
    RootCmd->>Config: load VeleroConfig
    Config-->>RootCmd: return config
    RootCmd->>RootCmd: isNonadminEnabled(config)
    alt non-admin enabled
        RootCmd->>Factories: use config (remove namespace override)
        RootCmd->>CmdMgr: construct commands
        RootCmd->>CmdMgr: filter out admin commands (keep nonadmin, client, completion)
        CmdMgr-->>RootCmd: filtered command set
    else admin mode
        RootCmd->>CmdMgr: construct commands (full set)
        CmdMgr-->>RootCmd: full command set
    end
    RootCmd->>User: present available commands

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 A hare in code with eager twitch,
Hides the admin, clears the switch.
BSL now shows its velero phase,
Nonadmin hops through safer ways. 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (1 warning, 2 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 42.86% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'Nonadmin only' is vague and generic, using non-descriptive phrasing that doesn't clearly convey the specific changes made to restrict CLI commands in non-admin mode.	Consider a more descriptive title like 'Hide admin commands when nonadmin mode is enabled' or 'Restrict CLI to non-admin commands in nonadmin mode'.
Linked Issues check	❓ Inconclusive	The PR partially addresses issue #128 by implementing command visibility filtering and nonadmin mode detection, but does not fully implement all requirements like NABSL auto-detection and prompt logic.	Verify that NABSL auto-detection and disambiguation logic are implemented separately or document planned implementation in follow-up PRs.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description check	✅ Passed	The pull request description follows the required template with both 'Why the changes were made' and 'How to test the changes made' sections completed.
Out of Scope Changes check	✅ Passed	All changes are focused on nonadmin mode enablement and command filtering. Changes to BSL output (Velero phase column) appear within scope for non-admin BSL operations support.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@cmd/root.go`:
- Around line 465-477: Update the allowedCmds set used inside the
isNonadminEnabled(config) branch so it matches the required nonadmin UX: include
"client", "help", and "nonadmin" and remove "completion"; modify the map literal
named allowedCmds (used with c.Commands() and cmd.Hidden) to only contain those
three keys so all other commands are hidden as intended.

[Joeavaikath]

@weshayutin Rather than just hiding it, what if we built the binary differently?
I have a flow where if the user identifies as a non-admin user, the built binary would only have non-admin commands
Uses a go build flag
If we leave it up to kubeconfig the user has to enable to manually don't they? Also it's mutable so they could remove that

[weshayutin]

@weshayutin Rather than just hiding it, what if we built the binary differently? I have a flow where if the user identifies as a non-admin user, the built binary would only have non-admin commands Uses a go build flag If we leave it up to kubeconfig the user has to enable to manually don't they? Also it's mutable so they could remove that

No.. shipping more binaries will be a headache

[Joeavaikath]

LGTM, hiding is better than nothing if we can't outright disable it

[coderabbitai]

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@cmd/root.go`:
- Around line 465-478: The visible commands set for nonadmin mode is incorrect:
update the allowedCmds map in the isNonadminEnabled block so it only permits
"client", "help", and "nonadmin" (remove "completion"); keep the loop over
c.Commands() and setting cmd.Hidden = true for any command whose cmd.Use is not
present in allowedCmds to ensure all other commands are hidden; this change
affects the allowedCmds variable inside the nonadmin branch in cmd/root.go where
isNonadminEnabled(config) is checked and c.Commands() is iterated.

[weshayutin]

/retest