mirror of
https://github.com/SigNoz/signoz.git
synced 2026-11-04 07:20:43 +00:00
67de630d03
#### Description Puts the notification channel screens on fine-grained authz. Stacked on #12976, which moves them onto the v2 API without touching authorization. - `notification-channel` was already enforced on the v2 routes but never reached the frontend: `cmd/authz.go` keeps an allowlist of the resources exposed to the generated permission types, and channels were missing from it. Adding it regenerates `permissions.type.ts`, and the panel entry makes the resource show up when editing a custom role. - Adds the permission builders (`list`/`create` at the collection, `read`/`update`/`delete` per channel) and the two hooks that read them, mirroring the dashboard helpers. - Swaps the role checks for those permissions on the list, the create button, the per-row actions, the form and the create/edit routes. #### Issues closed by this PR Closes https://github.com/SigNoz/pulse-pod/issues/290 #### Screenshots / Screen Recordings [Before and after, every channel screen](https://claude.ai/artifact/XGtzyX1B7ipNhdpMkJJEW4): swipe, fade or side-by-side between #12976 and this branch, one entry per Storybook story. 19 new permission states. The other 38 screens are pixel-identical, so nothing changes for a user who holds the permissions. The single exception is the list's loading state, where the skeleton is now inset to line up with the header band above it. #### Additional Information - `/alerts/channels/new` and `/alerts/channels/edit/:id` were ADMIN-only through the legacy role gate. They now run on authz, so a custom role granting `notification-channel:create` or `update` can reach them; `Private.test.tsx` is updated to match. - The verbs match what the routes enforce and what the managed roles already grant: admin gets create/read/update/delete/list, editor and viewer get read/list. `test` is deliberately gated on `create`, since a test send persists nothing and the channel need not exist. - With only `read` and `list`, the edit screen opens read-only rather than disappearing. - Generated file: `permissions.type.ts` is produced by `go run ./cmd/enterprise generate authz` and should not be hand-edited.