argoproj / argoproj/argo-workflows
UI: Inactivate buttons for actions not allowed by current permissions
- Dominant language
- Go
- Stars
- 17k
- Forks
- 3.7k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 138
Description
# Summary
Recently made a change to the argo-server role permissions to prevent our users from creating things via the UI. Based this on the recommendation here: https://argoproj.github.io/argo-workflows/security/#read-only
It would be REALLY nice if the Argo UI was aware of the fact that the current user does not have permission to, say, "+SUBMIT NEW WORKFLOW" and greyed out that button. Instead, it is still clickable, and just fails when the user tries to create a workflow.
# Use Cases
Any time you want to use the UI as a read-only option (or any iteration of permissions on the server, maybe you only want to block users from deleting workflow, then that button should grey out).
---
**Message from the maintainers**:
Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.
Contributor guide
Research direction
Start in the Argo UI handling for the “+SUBMIT NEW WORKFLOW” action and compare it with the argo-server read-only permissions described in the linked security guidance. Check how denied actions such as creating or deleting workflows are represented, then verify that unauthorized buttons are visibly inactive and cannot begin the operation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- authorization, frontend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100