oxidecomputer / oxidecomputer/console
Don't show add/edit role UI to non-admins
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 228
- Forks
- 22
- Avg merge
- 19h 42m
- Merged PRs (30d)
- 32
Description
If you don't have permission to update the policy on a resource, you can currently still see the add, edit, and delete buttons and open and submit the corresponding forms (you get 403s back from the API). We should check the user's role and not show them that stuff unless they're an admin. I believe viewers can still see the policy, however.
So: show the policy, but not the edit button.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the policy UI and its existing role or permission checks. Verify that viewers can still see the policy while non-admins do not see the add, edit, or delete controls or submit those forms; confirm the behavior no longer produces 403 responses from those actions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100