fix(rest-api): allow tenants to use provider templated OSes

[pbreton]

What changed

• allow tenants to select provider-owned templated iPXE Operating Systems when creating, updating, or batch-creating Instances
• keep tenant-owned Operating Systems private to their owning tenant
• retain the existing requirement that a provider-owned templated OS has a Synced association with the Instance site
• add regression coverage for all three Instance paths

Root cause

Provider-managed templated Operating Systems intentionally have no tenant_id. The Instance OS ownership checks called String() on that nil value and required every selected OS to be tenant-owned, even though the Operating System list API intentionally exposes provider-managed definitions to tenants at associated sites.

Impact

Tenants can now use provider-managed templated iPXE definitions that are synchronized to their Instance site. Cross-tenant definitions and provider definitions unavailable at that site remain rejected.

Validation

• reproduced the failure with a regression test; the create path panicked on the nil provider OS tenant_id
• go test ./api/pkg/api/handler -run '^TestBuildInstanceOsConfig_TemplatedIPXE$' -count=1
• go test ./api/pkg/api/handler -count=1
• make test from rest-api/
• git diff --check

Fixes #4486

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5f65da9f-2dcf-4fce-92e5-1fc7e3b474b0

📥 Commits

Reviewing files that changed from the base of the PR and between e442ecf and 28975e4.

📒 Files selected for processing (3)

• rest-api/api/pkg/api/handler/instance.go
• rest-api/api/pkg/api/handler/instance_test.go
• rest-api/api/pkg/api/handler/instancebatch.go

---

Summary by CodeRabbit

• New Features

  • Provider-owned, synchronized Templated iPXE operating systems can now be used when creating or updating instances.
  • Batch instance creation supports these operating systems and preserves their operating system configuration.

• Bug Fixes

  • Improved operating system authorization while retaining site-association validation for applicable configurations.

Walkthrough

The change adds shared authorization for tenant-owned and eligible provider-owned Templated iPXE Operating Systems. Instance creation, updates, and batch creation use this validation. Tests cover synchronized Site associations and ID-based configurations.

Changes

Operating System authorization

Layer / File(s)	Summary
Shared Operating System usability validation rest-api/api/pkg/api/handler/instance.go, rest-api/api/pkg/api/handler/instancebatch.go	The handlers use canTenantUseOperatingSystem. Tenant-owned Operating Systems and eligible provider-owned Templated iPXE Operating Systems pass validation. Other Operating Systems retain the existing bad-request response.
Provider-owned Operating System regression coverage rest-api/api/pkg/api/handler/instance_test.go	Tests add a synchronized provider-owned Templated iPXE Operating System and verify create, update, and batch-create configuration paths return its ID.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the primary change: allowing tenants to use provider-owned templated Operating Systems.
Description check	✅ Passed	The description directly explains the authorization change, constraints, regression coverage, root cause, and validation.
Linked Issues check	✅ Passed	The implementation satisfies issue #4486 by allowing tenant use of provider-owned templated Operating Systems while preserving site and tenant authorization rules.
Out of Scope Changes check	✅ Passed	The changes are limited to Operating System authorization and regression tests for instance creation, update, and batch creation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔐 TruffleHog Secret Scan

✅ No secrets or credentials found!

Your code has been scanned for 700+ types of secrets and credentials. All clear! 🎉

🔗 View scan details

_{🕐 Last updated: 2026-08-03 17:17:05 UTC | Commit: 28975e4}