Release hardening: five catalog fixes from the master-vs-26.7.4 review

catalog/CHANGELOG.md

@@ -21,6 +21,11 @@ complete sentence without it.
 
 ## Changes
 
+- [Fixed] Athena Queries: a console opened with a `?bucket=` scope — which every legacy per-bucket queries URL redirects to — honors that bucket's `ui.athena.defaultWorkgroup` again, and keeps that scope when you follow an execution or breadcrumb link inside the console; the workspace re-home had silently dropped the preference, landing customers on the alphabetically-first workgroup ([#5217](https://github.com/quiltdata/quilt/pull/5217))
+- [Fixed] Search sidebar: the "Sort by" control no longer disappears while typing in "Find metadata" on stacks with truncated facet lists, it is withheld when the query matches nothing rather than offering to sort an empty list, and it has an accessible name — its label used to land on a hidden input, reading as an unnamed button to assistive tech ([#5217](https://github.com/quiltdata/quilt/pull/5217))
+- [Fixed] Queries: the query selector announces its label to assistive tech, and no longer claims "Custom" is loaded while its helper text reports the query failed to load ([#5217](https://github.com/quiltdata/quilt/pull/5217))
+- [Fixed] Admin Users: a disabled Enabled or Admin switch explains why on hover or keyboard focus — "you can't deactivate yourself" and "managed by the stack" used to render as the same mute, dead control — and the roles dialog and Role column read as read-only end to end for service users rather than offering a Save the registry refuses ([#5217](https://github.com/quiltdata/quilt/pull/5217))
+- [Changed] With the `data-products` preview off, the demo fixture data no longer ships in the bundles a browser downloads on the volumes landing; the adapter behind the preview loads only when the feature is on ([#5217](https://github.com/quiltdata/quilt/pull/5217))
 - [Removed] The unbaked data-products GraphQL contract (added in [#5203](https://github.com/quiltdata/quilt/pull/5203), never served by a registry) is out of the schema; the `data-products` preview UI is unaffected and keeps reading fixture data ([#5223](https://github.com/quiltdata/quilt/pull/5223))
 - [Changed] Search sidebar: the package metadata list is sorted from one "Sort by" control, sitting directly above the list ([#5222](https://github.com/quiltdata/quilt/pull/5222))
 - [Fixed] Volumes list: the "Shared with" readout no longer overlaps a bucket's tags, and the extra space inside it is gone ([#5220](https://github.com/quiltdata/quilt/pull/5220))

catalog/app/containers/Admin/UsersAndRoles/Users.spec.tsx

@@ -0,0 +1,216 @@
+import * as React from 'react'
+import { render, cleanup, fireEvent, screen } from '@testing-library/react'
+import { describe, it, expect, vi, afterEach } from 'vitest'
+
+import { EditableSwitch, columns } from './Users'
+
+vi.mock('constants/config', () => ({ default: {} }))
+
+describe('containers/Admin/UsersAndRoles/Users', () => {
+  describe('EditableSwitch', () => {
+    afterEach(cleanup)
+
+    it('explains why it is disabled', async () => {
+      // A dead control with no cause is indistinguishable from a rendering
+      // bug -- and two causes (self, service user) share this column.
+      const { container } = render(
+        <EditableSwitch
+          hint="Deactivated users can't sign in"
+          disabled
+          disabledReason="This service user is managed by the stack"
+          checked
+          onChange={vi.fn()}
+        />,
+      )
+      expect(container.querySelector('input')?.disabled).toBe(true)
+      fireEvent.mouseOver(container.querySelector('span')!)
+      expect(
+        await screen.findByText('This service user is managed by the stack'),
+      ).toBeDefined()
+    })
+
+    it('carries the reason to keyboard and screen-reader users', async () => {
+      // The switch is disabled, so it is out of the tab order and fires no
+      // events: without a focusable, named wrapper the reason is mouse-only.
+      render(
+        <EditableSwitch
+          hint="Deactivated users can't sign in"
+          disabled
+          disabledReason="This service user is managed by the stack"
+          checked
+          onChange={vi.fn()}
+        />,
+      )
+      const wrapper = screen.getByLabelText('This service user is managed by the stack')
+      expect(wrapper.getAttribute('tabindex')).toBe('0')
+
+      fireEvent.focus(wrapper)
+      expect(
+        await screen.findByText('This service user is managed by the stack'),
+      ).toBeDefined()
+    })
+
+    it('keeps the hint on the enabled control', async () => {
+      const { container } = render(
+        <EditableSwitch
+          hint="Deactivated users can't sign in"
+          checked
+          onChange={vi.fn()}
+        />,
+      )
+      // MUI seeds the tooltip as a `title` before opening the popper; hover the
+      // node that actually carries it.
+      const titled = container.querySelector('[title]')!
+      expect(titled.getAttribute('title')).toBe("Deactivated users can't sign in")
+      fireEvent.mouseOver(titled)
+      expect(await screen.findByText("Deactivated users can't sign in")).toBeDefined()
+    })
+
+    it('renders a plain disabled switch when no reason is given', () => {
+      const { container } = render(
+        <EditableSwitch
+          hint="Deactivated users can't sign in"
+          disabled
+          checked
+          onChange={vi.fn()}
+        />,
+      )
+      expect(container.querySelector('input')?.disabled).toBe(true)
+    })
+  })
+
+  describe('the Admin column switch', () => {
+    afterEach(cleanup)
+
+    const column = columns.find((c) => c.id === 'isAdmin')!
+
+    function renderSwitch(user: object, isSelf = false) {
+      return render(
+        <>
+          {column.getDisplay!(undefined, user as never, { isSelf, openDialog: vi.fn() })}
+        </>,
+      )
+    }
+
+    it.each([
+      [
+        'a service user',
+        { isAdminAssignmentDisabled: true, isService: true },
+        false,
+        'This service user is managed by the stack',
+      ],
+      [
+        'an SSO-managed user',
+        { isAdminAssignmentDisabled: true, isService: false },
+        false,
+        'Admin capabilities for this user are managed by the SSO configuration',
+      ],
+      [
+        'yourself',
+        { isAdminAssignmentDisabled: false, isService: false },
+        true,
+        'You cannot change your own admin status',
+      ],
+    ])('says why it is disabled for %s', async (_label, user, isSelf, reason) => {
+      const { container } = renderSwitch({ name: 'u', isAdmin: false, ...user }, isSelf)
+      expect(container.querySelector('input')?.disabled).toBe(true)
+      fireEvent.mouseOver(container.querySelector('span')!)
+      expect(await screen.findByText(reason)).toBeDefined()
+    })
+
+    it('stays editable for an ordinary user', () => {
+      const { container } = renderSwitch({
+        name: 'u',
+        isAdmin: false,
+        isAdminAssignmentDisabled: false,
+        isService: false,
+      })
+      expect(container.querySelector('input')?.disabled).toBe(false)
+    })
+  })
+
+  describe('the Enabled column switch', () => {
+    afterEach(cleanup)
+
+    const column = columns.find((c) => c.id === 'isActive')!
+
+    function renderSwitch(user: object, isSelf = false) {
+      return render(
+        <>
+          {column.getDisplay!(
+            undefined,
+            user as never,
+            {
+              isSelf,
+              setActive: vi.fn(),
+            } as never,
+          )}
+        </>,
+      )
+    }
+
+    it.each([
+      [
+        'a service user',
+        { isService: true },
+        false,
+        'This service user is managed by the stack',
+      ],
+      ['yourself', { isService: false }, true, 'You cannot deactivate your own account'],
+    ])('says why it is disabled for %s', async (_label, user, isSelf, reason) => {
+      const { container } = renderSwitch({ name: 'u', isActive: true, ...user }, isSelf)
+      expect(container.querySelector('input')?.disabled).toBe(true)
+      fireEvent.mouseOver(container.querySelector('span')!)
+      expect(await screen.findByText(reason)).toBeDefined()
+    })
+
+    it('stays editable for an ordinary user', () => {
+      const { container } = renderSwitch({ name: 'u', isActive: true, isService: false })
+      expect(container.querySelector('input')?.disabled).toBe(false)
+    })
+  })
+
+  describe('the Role column', () => {
+    afterEach(cleanup)
+
+    const column = columns.find((c) => c.id === 'role')!
+
+    function renderRole(user: object) {
+      return render(
+        <>
+          {column.getDisplay!(
+            undefined,
+            { extraRoles: [], ...user } as never,
+            {
+              roles: [],
+              defaultRole: null,
+              openDialog: vi.fn(),
+            } as never,
+          )}
+        </>,
+      )
+    }
+
+    // The dialog this opens is read-only for both flags, so the invitation to
+    // edit must be gated on the same pair.
+    it.each([
+      ['an SSO-managed user', { isRoleAssignmentDisabled: true, isService: false }],
+      ['a service user', { isRoleAssignmentDisabled: false, isService: true }],
+    ])('offers only viewing for %s', (_label, user) => {
+      const { container } = renderRole(user)
+      expect(container.querySelector('[title]')?.getAttribute('title')).toBe(
+        'Click to view',
+      )
+    })
+
+    it('offers editing for an ordinary user', () => {
+      const { container } = renderRole({
+        isRoleAssignmentDisabled: false,
+        isService: false,
+      })
+      expect(container.querySelector('[title]')?.getAttribute('title')).toBe(
+        'Click to edit',
+      )
+    })
+  })
+})