fix: ensure user admins can always see users table #15226

Parkreiner · 2024-10-24T23:50:26Z

Changes made

Updated logic so that proxy config is only requested when appropriate, instead of for all users on all deployment pages
Split up the main context provider for the /deployment and /organizations routes, and updated layout logic for ManagementSettingsLayout layout component. This ensures the sidebar is always visible, even if request errors happen
Added additional routing safeguards to make sure that even if a user can view one page in the deployment section, they won't be able to navigate directly to any arbitrary deployment page
Updated logic for sidebar navigation to ensure that nav items only appear when the user truly has permission
Centralized a lot of the orgs logic into the useAuthenticated hook
Added additional check cases to the permissions.tsx file, to give more granularity, and added missing type-checking
Extended the API for the RequirePermissions component to let it redirect users anywhere
Updated some of our testing setup files to ensure that types were defined correctly

Parkreiner · 2024-10-25T00:03:59Z

site/src/contexts/auth/permissions.tsx

@@ -116,7 +126,6 @@ export const permissionsToCheck = {
 	[checks.viewAnyGroup]: {
 		object: {
 			resource_type: "group",
-			org_id: "any",


Ended up deleting this because the property wasn't compatible. It also didn't seem to be used anywhere

@Emyrk Not sure if we should update the types so that this can be added back

Can you delete this unused check then?

Oh, sorry – I meant that the org_id property specifically didn't seem to be used anywhere

site/src/modules/management/ManagementSettingsLayout.tsx

Parkreiner · 2024-10-25T00:10:40Z

site/src/modules/management/ManagementSettingsLayout.tsx

+type ManagementSettingsValue = Readonly<{
+	deploymentValues: DeploymentConfig | undefined;
+}>;


Removed most of the properties for two reasons:

The Sidebar component depended on the context provider. So it was impossible to show the sidebar at all times, because if you moved it outside the provider, it would blow up

It's duplicate state that was already accessible via other hooks. Felt better to beef those up, because then other pages would be able to benefit, too

Parkreiner · 2024-10-25T00:11:45Z

site/src/modules/management/SidebarView.tsx

@@ -130,10 +126,11 @@ const DeploymentSettingsNavigation: FC<DeploymentSettingsNavigationProps> = ({
 					{permissions.viewDeploymentValues && (
 						<SidebarNavSubItem href="network">Network</SidebarNavSubItem>
 					)}
-					{/* All users can view workspace regions.  */}


This actually wasn't true, so Steven and I had to put this behind a condition

Parkreiner · 2024-10-25T00:13:39Z

site/src/router.tsx

+					{/**
+					 * @todo 2024-10-24 - MES - The current deployment page is
+					 * almost empty, which isn't great for two reasons:
+					 *
+					 * 1. Even though none of our links lead to the page, the
+					 *    user is still able to navigate straight there by
+					 *    accident.
+					 * 2. If the user has access to some deployment pages, but
+					 *    tries accessing one that they shouldn't be able to
+					 *    access, we have to reroute them somewhere. The base
+					 *    deployment route is the only safe option, because not
+					 *    even the general page is accessible by everyone.
+					 *
+					 * Should update the base /deployment page so that there's
+					 * something there, but that will require coordination with
+					 * the design team.
+					 */}


I really wish I could've added some content here, but it felt really out of scope. At the very least, better a janky experience over a broken one

Maybe something to think together with @chrifro

Parkreiner · 2024-10-25T00:20:36Z

Will look into the failing E2E tests first thing tomorrow morning

BrunoQuaresma · 2024-10-25T17:57:15Z

site/src/contexts/auth/RequirePermission.tsx

@@ -3,18 +3,20 @@ import { Navigate } from "react-router-dom";

 export interface RequirePermissionProps {
 	children?: ReactNode;
-	isFeatureVisible: boolean;
+	permitted: boolean;
+	unpermittedRedirect?: `/${string}`;


Nit: Maybe redirectOnFailure?

BrunoQuaresma

I didn’t find any concerns, so I’m approving it. It would be good to have someone else do a second check and QA.

Parkreiner · 2024-10-28T14:08:28Z

@aslilac Would you be able to do a second glance-over for this PR? Like a third of the total lines of code is just a new unit test file; there weren't huge swashes of changes

Emyrk

Permissions LG. @Parkreiner and I did them in discord together 👍

aslilac · 2024-10-28T17:21:56Z

pls don't merge yet, I'm still reviewing

aslilac

I'm not a fan of moving state that can be localized up to a global provider where it will never be useful. I agree that the state currently being handled by ManagementSettingsLayout needs to be split back into two separate providers, but we shouldn't do it by misusing an existing provider, we should just reintroduce a DeploymentSettingsProvider.

aslilac · 2024-10-28T16:43:02Z

site/src/contexts/auth/RequirePermission.tsx

-	if (!isFeatureVisible) {
-		return <Navigate to="/workspaces" />;
+	if (!permitted) {
+		return <Navigate to={unpermittedRedirect} replace />;


I kinda feel like this is a bad abstraction. The user has to pass is the condition and the URL to navigate to, so why would we not want to just do

if (!allowedToSeeThing) { return <Navigate to="/some/place" replace /> }

...at the origin?

I don't think redirects like this should really be the job of this component–especially since I think it's a better user story to show an error page if they wound up somewhere they shouldn't be instead of just shoving them somewhere they didn't expect to go with no explaination

No, that's a really fair call. I wouldn't be opposed to ripping this out, since the abstraction is so shallow

aslilac · 2024-10-28T16:46:23Z

site/src/modules/dashboard/DashboardProvider.tsx

 import { selectFeatureVisibility } from "./entitlements";

 export interface DashboardValue {
 	entitlements: Entitlements;
 	experiments: Experiments;
 	appearance: AppearanceConfig;
 	organizations: readonly Organization[];
+	activeOrganization: Organization | undefined;


this value is already provided by ManagementSettingsLayout, and the concept of a "current organization" is only relevant inside that context. no need to add this.

aslilac · 2024-10-28T17:41:29Z

site/jest.setup.ts

-		getRandomValues: function (buffer: Buffer) {
-			return crypto.randomFillSync(buffer);
-		},
+		getRandomValues: (b: NodeJS.ArrayBufferView) => crypto.randomFillSync(b),


you could even take this a step further and just say...

Suggested change

getRandomValues: (b: NodeJS.ArrayBufferView) => crypto.randomFillSync(b),

getRandomValues: crypto.randomFillSync,

aslilac · 2024-10-28T17:47:25Z

site/src/contexts/auth/permissions.tsx

+	viewNotificationTemplate: "viewNotificationTemplate",
+} as const satisfies Record<string, string>;
+
+type PermissionType = keyof typeof checks;


this is technically incorrect, and only working because all of the key value pairs are symmetrical. what you really want is...

Suggested change

type PermissionType = keyof typeof checks;

type PermissionType = typeof checks[keyof typeof checks];

aslilac · 2024-10-28T17:51:40Z

site/src/modules/management/ManagementSettingsLayout.tsx

@@ -48,61 +47,134 @@ export const canEditOrganization = (
 	);
 };

+export const isManagementRoutePermitted = (


yeah, this feels like total overkill to me, especially for a quick patch this is a huge departure from how we handle this sort of thing everywhere else in the app

Parkreiner · 2024-10-28T23:18:42Z

@aslilac This should be good to go, but I got sloppy with the branch merging compared to the one I did for your draft branch. Let me know if you'd rather just reopen that draft PR, just to be on the super-safe side

I'll be looking at GitHub later tonight to try getting either one of the PRs merged in. If you do choose to go with your draft PR, you can review it as normal, and then I can approve it if you do

aslilac · 2024-10-29T00:50:03Z

site/src/pages/DeploymentSettingsPage/NotificationsPage/NotificationsPage.tsx


+	const ready = !!(templatesByGroup.data && dispatchMethods.data);


nit: prefer Boolean(…) over !!(…), it makes it much clearer that you want a boolean cast

So do I, but for some reason, when I tried to change things, it wasn't doing anything with type narrowing

site/src/pages/ManagementSettingsPage/OrganizationProvisionersPage.tsx

site/src/pages/ManagementSettingsPage/OrganizationSettingsPage.tsx

Parkreiner added 10 commits October 24, 2024 19:42

refactor: update layout so that sidebar always shows

1ad09fa

refactor: consolidate logic more

620bd3a

fix: add redirect for base users

7ee3cf0

fix: update routing logic to not block on disabled queries

e889621

fix: update type misalignment

36e0376

chore: format and tidy up

032a75c

fix: make sure you can't navigate directly to bare /deployment page

eea8bbd

fix: add more granularity to redirect logic

e6d4201

fix: prevent infinite redirect

14fc68e

fix: update redirects for /organizations routes

a8fd9e6

Parkreiner requested review from BrunoQuaresma and Emyrk October 24, 2024 23:50

Parkreiner self-assigned this Oct 24, 2024

fix: format files

0a36cd1

Parkreiner commented Oct 25, 2024

View reviewed changes

fix: tighten up types for permissions

e6d772b

Parkreiner commented Oct 25, 2024

View reviewed changes

site/src/modules/management/ManagementSettingsLayout.tsx Outdated Show resolved Hide resolved

Parkreiner commented Oct 25, 2024

View reviewed changes

Parkreiner removed request for BrunoQuaresma and Emyrk October 25, 2024 13:33

Parkreiner added 7 commits October 25, 2024 13:52

Merge branch 'main' into mes/deploy-bug

3752af5

fix: update route checks to account for subroutes

2068a4c

fix: add e2e check to ensure that redirect hasn't happened

2fe3d53

fix: update stories to account for new dashboard logic

3c41de0

fix: update out-of-date comment

162642e

fix: update default value logic for storybook setup

64c6f29

fix: update individual stories

e12a4aa

Parkreiner added 2 commits October 25, 2024 15:57

fix: finish storybook injection changes

b9b33c0

fix: add back separate empty state to satisfy tests

f7df5ff

Parkreiner requested review from BrunoQuaresma and Emyrk October 25, 2024 16:24

BrunoQuaresma reviewed Oct 25, 2024

View reviewed changes

BrunoQuaresma approved these changes Oct 25, 2024

View reviewed changes

Parkreiner added 2 commits October 25, 2024 21:10

fix: add tests and update code to account for missing cases

6925294

fix: apply formatting

9fc0afa

Parkreiner requested a review from aslilac October 28, 2024 14:03

Emyrk approved these changes Oct 28, 2024

View reviewed changes

aslilac requested changes Oct 28, 2024

View reviewed changes

aslilac and others added 9 commits October 28, 2024 18:15

break out DeploymentSettingsProvider

498e7ba

fix: apply changes from previous PR

234c606

fix: apply formatting

4496a75

Merge branch 'main' into mes/deploy-bug

9fcf3e7

Merge branch 'lilac/deployment-settings-provider' into mes/deploy-bug

19fb6e5

fix: delete invalid tests

804255e

fix: revert changes not caught in merge

d341175

fix: update spellcheck

f3e6659

fix: revert nits

ce67a66

Parkreiner requested a review from aslilac October 28, 2024 23:17

aslilac approved these changes Oct 29, 2024

View reviewed changes

fix: apply feedback

7e946a7

Parkreiner merged commit 1d925ab into main Oct 29, 2024
27 checks passed

Parkreiner deleted the mes/deploy-bug branch October 29, 2024 05:06

github-actions bot locked and limited conversation to collaborators Oct 29, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: ensure user admins can always see users table #15226

fix: ensure user admins can always see users table #15226

Parkreiner commented Oct 24, 2024 •

edited

Loading

Parkreiner Oct 25, 2024

Emyrk Oct 25, 2024

Parkreiner Oct 25, 2024

Parkreiner Oct 25, 2024

Parkreiner Oct 25, 2024

Parkreiner Oct 25, 2024

BrunoQuaresma Oct 25, 2024

Parkreiner commented Oct 25, 2024

BrunoQuaresma Oct 25, 2024

BrunoQuaresma left a comment

Parkreiner commented Oct 28, 2024

Emyrk left a comment

aslilac commented Oct 28, 2024

aslilac left a comment

aslilac Oct 28, 2024

Parkreiner Oct 28, 2024

aslilac Oct 28, 2024

aslilac Oct 28, 2024

aslilac Oct 28, 2024

aslilac Oct 28, 2024

Parkreiner commented Oct 28, 2024 •

edited

Loading

aslilac Oct 29, 2024

Parkreiner Oct 29, 2024

	getRandomValues: (b: NodeJS.ArrayBufferView) => crypto.randomFillSync(b),
	getRandomValues: crypto.randomFillSync,

	type PermissionType = keyof typeof checks;
	type PermissionType = typeof checks[keyof typeof checks];


		const ready = !!(templatesByGroup.data && dispatchMethods.data);

fix: ensure user admins can always see users table #15226

fix: ensure user admins can always see users table #15226

Conversation

Parkreiner commented Oct 24, 2024 • edited Loading

Changes made

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Parkreiner commented Oct 25, 2024

Choose a reason for hiding this comment

BrunoQuaresma left a comment

Choose a reason for hiding this comment

Parkreiner commented Oct 28, 2024

Emyrk left a comment

Choose a reason for hiding this comment

aslilac commented Oct 28, 2024

aslilac left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Parkreiner commented Oct 28, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Parkreiner commented Oct 24, 2024 •

edited

Loading

Parkreiner commented Oct 28, 2024 •

edited

Loading