Added cancel permission

[breadddevv]

Summary by CodeRabbit

• New Features

  • Added a dedicated permission for cancelling sessions by session type.
  • Authorized session managers and users with cancellation permission can now cancel sessions.
  • Added cancellation access checks to the sessions page.

• Bug Fixes

  • Session refresh now displays a single success notification instead of duplicate messages.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Session controls

Layer / File(s)	Summary
Cancellation permission contract utils/sessionPermissions.ts, components/settings/permissions/roles.tsx	Session permission actions and role mappings now include session cancellation.
Session cancellation UI wiring pages/workspace/[id]/sessions.tsx, components/sessioncard.tsx	Workspace permissions are passed to the session modal, which displays cancellation controls for managers or users with cancellation permission.
Session refresh notification components/topbar.tsx	The sessions fetch function now owns the success toast, avoiding duplicate notifications from the refresh button.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant WorkspaceSessions
  participant canCancelSession
  participant SessionTemplate
  participant SessionModal
  WorkspaceSessions->>canCancelSession: Evaluate workspace permission and session type
  canCancelSession-->>WorkspaceSessions: Return canCancel
  WorkspaceSessions->>SessionTemplate: Pass canCancel
  SessionTemplate->>SessionModal: Pass canCancel
  SessionModal->>SessionModal: Render cancellation section when canManage or canCancel

Loading

Suggested reviewers: buddywinte

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding cancel-session permission support.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch add/permission-cancel

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

components/topbar.tsx (1)

73-78: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Only show the success toast for explicit refreshes.

fetchSessions is also called when the user first opens the Sessions panel, so this unconditional toast displays “Sessions refreshed” during initial loading. Add a showToast parameter or separate the initial-load and refresh functions, then call the toast only from the refresh button.

Suggested fix

-  const fetchSessions = async () => {
+  const fetchSessions = async (showToast = false) => {
     setSessionsLoading(true);
     try {
       const res = await axios.get("/api/user/sessions");
       setSessions(res.data.sessions || []);
-      toast.success("Sessions refreshed")
+      if (showToast) toast.success("Sessions refreshed");

-                        onClick={fetchSessions}
+                        onClick={() => fetchSessions(true)}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@components/topbar.tsx` around lines 73 - 78, Update fetchSessions so the
“Sessions refreshed” success toast is conditional and only enabled for explicit
refresh actions. Pass a showToast flag from the refresh button while leaving the
initial Sessions panel load silent; preserve the existing session-fetching and
loading behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@components/sessioncard.tsx`:
- Line 731: Update the session action condition near the canManage/canCancel
check so the Uncancel control is rendered only when canManage is true, while
preserving the existing cancelled-state guard and cancel-only behavior.

---

Outside diff comments:
In `@components/topbar.tsx`:
- Around line 73-78: Update fetchSessions so the “Sessions refreshed” success
toast is conditional and only enabled for explicit refresh actions. Pass a
showToast flag from the refresh button while leaving the initial Sessions panel
load silent; preserve the existing session-fetching and loading behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5635f683-5323-49c9-9d9a-0f92e5f3ee96

📥 Commits

Reviewing files that changed from the base of the PR and between 396d224 and 6df8688.

📒 Files selected for processing (5)

• components/sessioncard.tsx
• components/settings/permissions/roles.tsx
• components/topbar.tsx
• pages/workspace/[id]/sessions.tsx
• utils/sessionPermissions.ts

[coderabbitai]

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n 'sessions/.*/cancel|canCancelSession|sessions_[^"]*_cancel' .

Repository: PlanetaryOrbit/orbit

Length of output: 917

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== components/sessioncard.tsx (relevant ranges) =="
sed -n '180,280p' components/sessioncard.tsx
echo
sed -n '700,770p' components/sessioncard.tsx
echo
echo "== utils/sessionPermissions.ts =="
cat -n utils/sessionPermissions.ts
echo
echo "== API route search =="
rg -n 'cancelled|uncancel|restore|canCancelSession|canManageSession|authorize|permission' pages components utils api -g '!**/node_modules/**'

Repository: PlanetaryOrbit/orbit

Length of output: 50376

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== pages/api/workspace/[id]/sessions/[sid]/cancel.ts (full) =="
cat -n pages/api/workspace/[id]/sessions/[sid]/cancel.ts

echo
echo "== permission wrapper and session permission helpers =="
sed -n '1,260p' utils/permissionsManager.ts 2>/dev/null || true
sed -n '1,220p' utils/sessionPermissions.ts

Repository: PlanetaryOrbit/orbit

Length of output: 14145

---

Hide the Uncancel action behind manage access. The DELETE route already requires sessions_*_manage, but the button is still rendered for any cancelled session. That leaves users with cancel-only access at a dead end. Either gate this control on canManage or add a separate uncancel permission and enforce it server-side too.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@components/sessioncard.tsx` at line 731, Update the session action condition
near the canManage/canCancel check so the Uncancel control is rendered only when
canManage is true, while preserving the existing cancelled-state guard and
cancel-only behavior.