fix(bootstrap): harden AppendSchema against list errors and missing metadata description

[rohilsurana]

What

Fixes two long-standing bugs in bootstrap.AppendSchema. Both are already on main and are independent of the boot loader removal work.

1. A failed permission list was swallowed

existingPermissions, err := s.permissionService.List(ctx, permission.Filter{})
if err != nil {
    return nil // <- returns success without applying the schema
}

When the list call failed, AppendSchema returned nil before applySchema ran. So a transient list error at boot skipped the schema re-apply but still reported success. Nothing was applied and nothing was dropped, but boot looked healthy while silently doing no schema work. On a first boot, where the base schema has not been applied yet, that leaves the server with no schema at all. The fix returns the wrapped error so boot stops instead of reporting a false success.

2. The metadata description read had inverted logic and could panic

if v, ok := existingPermission.Metadata["description"]; !ok {
    description = v.(string) // <- runs only when the key is absent, then asserts nil to string
}

The !ok branch runs only when the description key is missing. In that case v is a nil any, so v.(string) panics. When the key is present, the value was ignored and the description was dropped. The logic is now pulled into a small permissionDescription helper that reads the value when present, returns "" when it is missing or not a string, and never panics.

Why now

These are pre-existing bugs, but #1767 removes the boot-time config schema loader and makes AppendSchema the only path that applies the schema at boot. That raises how much these two edge cases matter, so it is worth fixing them on their own.

Tests

• Test_AppendSchema proves a list error is returned, not swallowed.
• Test_permissionDescription covers nil metadata, a present string, a missing key, and a non-string value (the last two used to panic).
• Test_existingPermissionsAsServiceDefinition covers the mapping from existing permissions into the schema, so a wrong field or dropped description is caught.

go build ./..., go vet ./..., go test ./internal/bootstrap/... pass. gofmt and golangci-lint clean.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview	Aug 11, 2026 10:07am

[coderabbitai]

Warning

Review limit reached

@rohilsurana, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 11 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9241f04d-f008-4026-9744-fbd7a3e53807

📥 Commits

Reviewing files that changed from the base of the PR and between 8e22bcf and 9fa5403.

📒 Files selected for processing (2)

• internal/bootstrap/service.go
• internal/bootstrap/service_test.go

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 31480747341

Coverage increased (+0.05%) to 48.146%

Details

• Coverage increased (+0.05%) from the base build.
• Patch coverage: 3 uncovered changes across 1 file (14 of 17 lines covered, 82.35%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
internal/bootstrap/service.go	17	14	82.35%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	39922
Covered Lines:	19221
Line Coverage:	48.15%
Coverage Strength:	15.37 hits per line

---

💛 - Coveralls

[rohilsurana]

Automated code review (xhigh). Findings below. One behavior question, one test-comment fix, a coverage gap, and a small simplification.