Repository navigation
fix(rbac): gate the configuration toggles and the user and role Edit actions on their write permissions - #823
Open
CaptainAni187 wants to merge 1 commit into
Conversation
…actions on their write permissions
Contributor
E2E — mocked backend🎭 E2E Tests✅ All green — 429 passed · 0 failed · 1 skipped, across 40 spec files in 9m 29s. By spec file
All 430 tests — click to expand
Slowest 10 — what the shard counts should be tuned against
📼 Download the HTML report, videos and traces — see the Generated by run 39365579511 from |
Contributor
E2E — real Fineract🎭 E2E Tests✅ All green — 171 passed · 0 failed · 0 skipped, across 50 spec files in 10m 56s. By spec file
All 171 tests — click to expand
Slowest 10 — what the shard counts should be tuned against
📼 Download the HTML report, videos and traces — see the Generated by run 39365579511 from |
Contributor
🔄 What this change talks toFrom the 3 application TypeScript file(s) changed in this pull request. sequenceDiagram
autonumber
participant RolesListComponent as RolesListComponent (Component)
participant ROLE_API as ROLE_API (Injected)
participant Router as Router (Injected)
participant DialogService as DialogService (Injected)
participant I18N as I18N (Injected)
participant NotificationService as NotificationService (Injected)
participant UsersListComponent as UsersListComponent (Component)
participant USER_API as USER_API (Injected)
participant AuthService as AuthService (Injected)
participant GlobalConfigurationsListComponent as GlobalConfigurationsListComponent (Component)
participant GlobalConfigurationService as GlobalConfigurationService (API client)
participant Fineract as Fineract (REST API)
RolesListComponent->>ROLE_API: list()
RolesListComponent->>Router: navigate()
RolesListComponent->>DialogService: confirm()
RolesListComponent->>I18N: translate()
RolesListComponent->>ROLE_API: setEnabled()
RolesListComponent->>NotificationService: success()
RolesListComponent->>ROLE_API: delete()
UsersListComponent->>USER_API: list()
UsersListComponent->>Router: navigate()
UsersListComponent->>AuthService: currentUser()
UsersListComponent->>DialogService: confirm()
UsersListComponent->>I18N: translate()
UsersListComponent->>USER_API: delete()
UsersListComponent->>NotificationService: success()
GlobalConfigurationsListComponent->>GlobalConfigurationService: getConfigurations()
GlobalConfigurationService->>Fineract: getConfigurations()
Fineract-->>GlobalConfigurationService: response
GlobalConfigurationsListComponent->>GlobalConfigurationService: putConfigurationsConfigId()
GlobalConfigurationService->>Fineract: putConfigurationsConfigId()
Fineract-->>GlobalConfigurationService: response
GlobalConfigurationsListComponent->>NotificationService: success()
GlobalConfigurationsListComponent->>NotificationService: error()
GlobalConfigurationsListComponent->>DialogService: open()
Generated by run 39365579418 from |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
A user with only
ALL_FUNCTIONS_READgot enabled write controls on three admin screens: the Global Configurations toggles and Edit, and Edit on Users and Roles. Fineract refuses all of them, so the user just ends up on a 403 toast or on Access Denied.appRequiresPermission="UPDATE_CONFIGURATION", so they stay visible (the toggle still shows the current state) but disabled, with the same "Requires ..." hint as the loan and savings actions.*appHasPermissiononUPDATE_USER/UPDATE_ROLE, the codes their edit routes already require. That matches Delete, Enable and Disable next to it, which are already hidden the same way.Closes #769
Verification
users-list.component.test.tsandroles-list.component.test.tsfor Edit with and without the permission.e2e/all-functions-read-shortcut.spec.ts: anALL_FUNCTIONS_READuser goes through all three screens, the toggle and Edit are disabled, clicking them sends no write, and Users/Roles have no Edit. Paired with anALL_FUNCTIONSuser who still gets all of them. Both fail on main.I didn't extend
rbac-dead-end-controls.spec.tssince it needs the backend stack, the mocked spec covers the same check.... happy to add a backend case there too if you want.Screenshots
Global Configurations as
ALL_FUNCTIONS_READ, before / after:Users as
ALL_FUNCTIONS_READ, before / after:AI assistance (optional)
Checklist
src/app/api/.src/app/core/adapters/instead of direct browser globals or imperative third-party APIs.