argoproj / argoproj/argo-workflows

UI: Inactivate buttons for actions not allowed by current permissions

Open
#6,243 4 comments 7 reactions 0 assignees View on GitHub
area/ui
Dominant language
Go
Stars
17k
Forks
3.7k
Avg merge
1d 20h
Merged PRs (30d)
138

Description

# Summary

Recently made a change to the argo-server role permissions to prevent our users from creating things via the UI. Based this on the recommendation here: https://argoproj.github.io/argo-workflows/security/#read-only

It would be REALLY nice if the Argo UI was aware of the fact that the current user does not have permission to, say, "+SUBMIT NEW WORKFLOW" and greyed out that button. Instead, it is still clickable, and just fails when the user tries to create a workflow.

# Use Cases

Any time you want to use the UI as a read-only option (or any iteration of permissions on the server, maybe you only want to block users from deleting workflow, then that button should grey out).

---

**Message from the maintainers**:

Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.

Contributor guide

Open the contributing guide

Research direction

Start in the Argo UI handling for the “+SUBMIT NEW WORKFLOW” action and compare it with the argo-server read-only permissions described in the linked security guidance. Check how denied actions such as creating or deleting workflows are represented, then verify that unauthorized buttons are visibly inactive and cannot begin the operation.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
authorization, frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.