mirror of
https://github.com/SigNoz/signoz.git
synced 2026-09-14 07:20:41 +01:00
206aad1acd
#### Description Registers the `dashboard` authz kind and adds the shared pieces the two dashboard PRs stack on. No dashboard UI changes here. - **Registers `dashboard`** in `cmd/authz.go` and regenerates `permissions.type.ts`. `public-dashboard` is deliberately *not* registered: those routes are open access, the only verb any of them checks is an anonymous read seeded by migration, and nothing in the frontend builds a permission against the kind. - **Adds a Dashboards panel** to the custom-role editor. The map stays a total `Record`, so a newly registered resource still has to be given a panel — its length assertions are that guard. - **`disabledTooltip` on `AuthZTooltip` / `AuthZButton`**, for a block the consumer already knows about that is *not* a permission — a lock, an integration dashboard, a deliberately read-only mount. It takes precedence over `checks`, which are then **skipped entirely** rather than fetched for a control that is unavailable either way. Callers set it only when that block is the real obstacle, so a missing permission still surfaces its own standard wording. That is how `update` ends up outranking the lock. - **`preloadChecks` on the HOCs**, fetched in the same batch as `checks` and never gated on, so a control below the guard resolves from cache instead of firing a second round trip and flipping once it lands. `AuthZGuard` is untouched. - `AuthZTooltip` also takes `side` and `tooltipMessage`, and keeps its reason up when the dead control is clicked — Radix closes on both pointerdown and click, and merges its own handlers after the trigger's regardless of `preventDefault`, so the close is filtered in the component. - **Dashboard permission hooks**: `canEdit` is `read && update` per guide rule 2, `read` reports loading separately from the rest, and the lock hook checks `dashboard:update` plus the one non-permission rule the handler adds — an integration dashboard can never be locked. #### Screenshots / Screen Recordings <img width="1435" height="945" alt="Screenshot 2026-09-10 at 11 32 56 PM" src="https://github.com/user-attachments/assets/560ae704-e83a-4207-bceb-ada7a5e75a78" /> <img width="1421" height="678" alt="Screenshot 2026-09-10 at 11 32 41 PM" src="https://github.com/user-attachments/assets/4d02dcda-e985-4db7-b77a-433b6de23db5" /> #### Additional Information - **Denial copy comes from the components.** There is no dashboard permission-message module any more; the non-permission strings live in the i18n bundle. `useIsOrgAdmin` goes with it — the lock was its only caller. - The lock hook no longer considers who created the dashboard — access is decided by role. **The handler still enforces creator-or-admin**, so that check wants removing backend-side too, or a non-creator with `update` gets an enabled Unlock and a 403. - The grant-all MSW default is gone: each suite states the permissions it needs, so an authz test can't pass for the wrong reason. - Stacked: #12438 then #12449, and rebased onto current `main`. The three squash-merge in order with no conflicts — verified by replaying the whole sequence locally, including the two files this PR shares with #12449 (`utils/permission/index.ts` and `AppRoutes/__tests__/Private.test.tsx`, additions ~24 and ~68 lines apart). Each branch above needs a rebase after the one below merges.