fix: issues found in PBAC creation #22659
Conversation
WalkthroughThe changes introduce a new optional boolean property, Estimated code review effort3 (30–60 minutes) Possibly related PRs
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/AdvancedPermissionGroup.tsxOops! Something went wrong! :( ESLint: 8.57.1 ESLint couldn't find the plugin "eslint-plugin-playwright". (The package "eslint-plugin-playwright" was not found when loaded as a Node module from the directory "".) It's likely that the plugin isn't installed correctly. Try reinstalling by running the following: The plugin "eslint-plugin-playwright" was referenced from the config file in ".eslintrc.js". If you still can't figure out the problem, please stop by https://eslint.org/chat/help to chat with the team. 📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
✨ Finishing Touches
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
Hey there and thank you for opening this pull request! 👋🏼 We require pull request titles to follow the Conventional Commits specification and it looks like your proposed title needs to be adjusted. Details: |
dosubot
bot
added
organizations
|
✅ No security or compliance issues detected. Reviewed everything up to ea72ef9. Security Overview
Detected Code Changes
Reply to this PR with |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🔭 Outside diff range comments (1)
apps/web/app/(use-page-wrapper)/settings/(settings-layout)/SettingsLayoutAppDirClient.tsx (1)
270-270: Add missing dependency to useMemo.The
canViewRolesprop should be included in the dependency array since it's used in the memoized computation.- }, [isAdmin, orgBranding, isOrgAdminOrOwner, user, isDelegationCredentialEnabled]); + }, [isAdmin, orgBranding, isOrgAdminOrOwner, user, isDelegationCredentialEnabled, isPbacEnabled, canViewRoles]);
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
apps/web/app/(use-page-wrapper)/settings/(settings-layout)/SettingsLayoutAppDirClient.tsx(9 hunks)apps/web/app/(use-page-wrapper)/settings/(settings-layout)/layout.tsx(3 hunks)apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/AdvancedPermissionGroup.tsx(1 hunks)apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/usePermissions.ts(4 hunks)apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/actions.ts(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/AdvancedPermissionGroup.tsx (1)
Learnt from: alishaz-polymath
PR: #22304
File: packages/features/eventtypes/components/MultiplePrivateLinksController.tsx:92-94
Timestamp: 2025-07-16T06:42:27.001Z
Learning: In the MultiplePrivateLinksController component (packages/features/eventtypes/components/MultiplePrivateLinksController.tsx), the currentLink.maxUsageCount ?? 1 fallback in the openSettingsDialog function is intentional. Missing maxUsageCount values indicate old/legacy private links that existed before the expiration feature was added, and they should default to single-use behavior (1) for backward compatibility.
🧬 Code Graph Analysis (1)
apps/web/app/(use-page-wrapper)/settings/(settings-layout)/SettingsLayoutAppDirClient.tsx (1)
packages/features/shell/Shell.tsx (1)
Shell(111-124)
🪛 Biome (1.9.4)
apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/usePermissions.ts
[error] 93-95: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.
The declaration is defined in this switch clause:
Unsafe fix: Wrap the declaration in a block.
(lint/correctness/noSwitchDeclarations)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: required
- GitHub Check: Detect changes
- GitHub Check: Security Check
🔇 Additional comments (9)
apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/actions.ts (1)
12-16: LGTM! Expanded cache invalidation coverage.The addition of general cache tags alongside team-specific ones ensures that permission-related cached data is properly refreshed when team roles change. This supports the new permission checking logic introduced in the layout components.
apps/web/app/(use-page-wrapper)/settings/(settings-layout)/layout.tsx (3)
29-36: LGTM! Well-structured cached permission fetching.The new
getCachedResourcePermissionsfunction follows Next.js caching best practices with appropriate cache keys and revalidation settings. The 120-second revalidation aligns with the existinggetTeamFeaturesfunction.
46-46: LGTM! Proper permission checking implementation.The server-side permission checking correctly:
- Fetches role permissions concurrently with team features
- Uses
PermissionMapper.toActionMapto convert permissions to actionable flags- Checks for read permission on roles before enabling UI visibility
- Handles the case where features might not exist
Also applies to: 51-63
69-69: LGTM! Clean prop threading to client component.The
canViewRolesflag is properly passed to the client component, enabling permission-based UI rendering.apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/usePermissions.ts (1)
22-26: LGTM! Consistent filtering of internal permission keys.The filtering of actions that start with "_" is consistently applied across all permission enumeration functions. This properly excludes internal/meta keys from user-actionable permissions while maintaining the same logic pattern throughout.
Also applies to: 35-37, 49-52
apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/AdvancedPermissionGroup.tsx (2)
71-85: LGTM! Improved click handling prevents unintended interactions.The refined click handling logic properly separates concerns:
- Button only toggles on direct clicks (excluding children)
- Icon area has independent toggle handler
- Icon rotation changed to more conventional 90 degrees
This prevents the dropdown from closing unexpectedly when users interact with child elements.
93-102: LGTM! Enhanced text interactivity.Making the text spans clickable with proper cursor styling improves user experience by providing larger click targets for expanding/collapsing the permission group.
apps/web/app/(use-page-wrapper)/settings/(settings-layout)/SettingsLayoutAppDirClient.tsx (2)
187-191: LGTM! Proper permission-based menu filtering.The implementation correctly combines feature flag checking (
isPbacEnabled) with permission checking (canViewRoles) to ensure the roles and permissions menu item only appears when both conditions are met. This addresses the original issue where the menu would appear for users without proper permissions.Also applies to: 228-235
297-297: LGTM! Comprehensive prop threading implementation.The
canViewRolesprop is properly threaded through all necessary components in the hierarchy, enabling consistent permission-based UI behavior throughout the settings layout.Also applies to: 490-490, 520-520, 795-795, 801-801, 836-836, 859-859, 867-867, 884-884
...pper)/settings/(settings-layout)/organizations/roles/_components/AdvancedPermissionGroup.tsx
Outdated
Show resolved
Hide resolved
...e-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/usePermissions.ts
Outdated
Show resolved
Hide resolved
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎ |
sean-brydon
changed the title
joeauyeung
left a comment
joeauyeung
left a comment
There was a problem hiding this comment.
I'll approve this PR for the UI fixes.
Although something we need to follow up on sooner rather than later is deleting permissions. Right now when removing permissions from a role, we're not deleting those permissions in the RolePermissions table.
https://cap.link/j1pbhrg4pw2r0r3
Graphite Automations"Add ready-for-e2e label" took an action on this PR • (07/22/25)1 label was added to this PR based on Keith Williams's automation. |
E2E results are ready! |
4 participants
What does this PR do?
Fixes the issues found here: #22467 (review)