Repository navigation
feat(web): show analysts no control the API refuses them - #2552
Merged
Merged
Conversation
The policy table now names the changes a member can make and an observer cannot. The API refuses them all in one place; these names are for the dashboard, so a page can leave out controls that would only fail. On the dashboards list, a board and the templates gallery, a viewer without dashboards:edit gets no create, import, duplicate, tag, delete, edit mode, rename or version restore, and one without dashboards:share gets no Share or Embed chart. Opening a board with ?mode=edit shows them the read view. Reading stays whole: time range, variables, version history and JSON export.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 17 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
This comment has been minimized.
This comment has been minimized.
On the errors list and an issue, a viewer without error_issues:triage reads everything but gets no status or severity picker, claim, release, merge or unmerge, pull request attach or detach, comment box, row selection or bulk bar. The pickers become plain readouts, and the list's x, s and p shortcuts do nothing for them. The Get it fixed panel needs investigations:run: without it, an observer sees an investigation that already ran but is offered neither a new one nor the agent prompt, which tells an agent to claim the issue.
Makisuo
changed the title
This comment has been minimized.
This comment has been minimized.
A viewer without incidents:respond gets no Acknowledge on an alert incident or an inbox row, and no Resolve, link or unlink on an anomaly. One without status_page_incidents:post gets no Post incident, Post update, Resolve, Edit details or Delete on a status page. One without investigations:run gets no investigate bar on the investigations list and no Investigate on an incident or anomaly. Controls that already need alerts:manage or status_pages:edit are unchanged. The labs take ?role=admin|member|observer.
Makisuo
changed the title
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
# Conflicts: # packages/domain/src/policy/roles.ts
An analyst builds and shares dashboards like any other role, so the dashboard pages no longer read session grants or hide controls, and the dashboards:edit and dashboards:share permissions are gone. Errors, incidents, investigations and status pages still hide what the API refuses.
Makisuo
changed the title
Maple review🟢 Confidence 10/10 · safe to merge. All 59 files read; gates match the domain permission table and every page that reads grants fetches them, only the brief pre-session window differs from before. Hides the dashboard's write controls wherever the viewer's grants lack the matching permission: errors list and issue, incident and anomaly pages, status page editor, investigations list. The gates read the same domain permission table the API enforces, and the new scene tests pin both the analyst and member views.
|
Maple: after this shippedDeployed to New errors since the deploy:
Maple looks once, an hour after the first deploy that carries the merge. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sixth layer of the Analyst role, on top of #2550. The API already refuses an analyst every change outside dashboards; this layer stops the dashboard from offering the ones that would only fail, on Errors, incidents, investigations and status pages.
What changed
error_issues:triage,incidents:respond,investigations:run,status_page_incidents:post,recommendations:triage. The API enforces them in one place (the analyst gate), so these exist for pages to read.error_issues:triage: no row selection or bulk bar, the status and severity pickers are plain readouts, the right-click menu has no status or claim entries, and thex,sandpshortcuts do nothing.investigations:run. Without it, an analyst sees an investigation that already ran but is offered neither a new one nor the agent prompt.incidents:respond: no Acknowledge on an alert incident or an inbox row; no Resolve, Link issue or Unlink on an anomaly. Controls that already needalerts:manageare unchanged.status_page_incidents:post: no Post incident, Post update, Resolve, Edit details or Delete. Controls that already needstatus_pages:editare unchanged.investigations:run: no investigate bar on the list, and no Investigate on an incident or anomaly. A finished investigation still opens./lab/alerts,/lab/anomaly-alertsand/lab/status-pagestake?role=admin|member|analyst./lab/errors?role=and/lab/error-issue?role=render the pages for either viewer.Members, engineers and admins see what they saw before. In Clerk mode a page learns the viewer's grants a moment after it opens, so their write controls appear with that answer, as on the alerts pages.
Screenshots
Errors:
Incidents and status pages:
Verified
apps/web: the dashboards, errors, alerts hub and incident, anomalies, investigations, status pages and lab tests, 923 passed. Scene tests pair an analyst with a member on each gated page.packages/domain: policy tests, 16 passed.@maple/webtypecheck, the CI lint config on every changed file, the UI class pattern check and the kit index.Known gaps
alerts:manage.alerts:manage. That predates this work.