-
Notifications
You must be signed in to change notification settings - Fork 367
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
upcoming: [M3-7463] - Disable Billing access user permission for child users #10045
upcoming: [M3-7463] - Disable Billing access user permission for child users #10045
Conversation
Coverage Report: ✅ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice work @mjac0bs!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good!
Do childAccountAccessEnabled
and isAccountAccessRestricted
need to be in state? Can we just derive them from existing data?
The CI e2e failures are irrelevant to this PR and I connected with Banks offline regarding the above comment - we can't derive since user data isn't already stored in state. Going to go ahead and merge. 🚢 |
Description 📝
As a child user, the UI of the permissions page will be the same as global or non-parent/child, except for Billing Access. Billing Access will be set to "Read Only" with the option for unrestricted child users to switch it to "None" for other child users. "Read-Write" will always be disabled. In other words, child account users will have no permission greater than "Read Only" billing access.
Why are we enforcing this in the UI, rather than relying on the
account_access
grant?For an unrestricted (admin) child account user's
account_access
(which determines Billing Access), the API will returnread_write
in order for the user to have access to the rest of the user permissions, including managing those of their proxy user. Therefore, we need to make an additional check of theuser_type
to ensure on the front-end that we actually restrict billing access forchild
users.Changes 🔄
user-permissions.spec.ts
.Preview 📷
How to test 🧪
Prerequisites
(How to setup test environment)
yarn dev
.serverHandlers.ts
and edit theaccount/users/:user
request to the following in order to mock a child user:Verification steps
(How to verify changes)
As an Author I have considered 🤔
Check all that apply