Skip to content

Folder Permission Management#729

Open
jjoderis wants to merge 8 commits intomainfrom
folder-permission-management
Open

Folder Permission Management#729
jjoderis wants to merge 8 commits intomainfrom
folder-permission-management

Conversation

@jjoderis
Copy link
Copy Markdown
Contributor

Summary

Simplified the UI/UX for settings access rights on specific folders.

Details

  • inverted the way that access rights are managed in environments
    • instead of having to create a new role for every folder one can now set folder access rights per role
      • the underlying folder based role system has not changed but the MS handles the creation, update and removal of folder roles in the background
  • added new Column to the "Role" table for "parentRole" and "children"
    • roles that correspond to a folder are children of a user defined "parentRole"
  • added a new tab to the role view that handles "Folder Permissions"
    • for every folder that is managed here a new role is created that contains the permissions for the respective folder and that has the role that the user is working on as its parent
  • roles that have a "parentRole" are not shown as a editable role in the UI
  • added cancel buttons to the role update forms to undo unsaved changes and moved the buttons to the right
  • Fixed: Users without "manage" rights for processes are still shown the "Process Editor" options in the sidebar and on the start page and can navigate to these views as long has they have "view" rights for processes. They can also enter the process modeler and make changes but these changes are not persisted in the backend.

@github-actions

This comment has been minimized.

@github-actions
Copy link
Copy Markdown

CLOUDRUN ACTIONS

✅ Successfully created Preview Deployment.

https://pr-729---ms-server-staging-c4f6qdpj7q-ew.a.run.app

);

form.setFieldsValue(values);
}, [groups, form]);
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think including form in the dependency array could cause circular updates and I guess it doesn't need to be a dependency. This could also lead to unnecessary re-renders or infinite loops in edge cases. May be try to remove form from the dependencies.


const values = (await form.validateFields()) as Record<
string,
Record<ResourceType, Record<ResourceActionType, boolean>>
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If validateFields() or handleFolderRoleChanges() fails, then loading will never be set to false and users will not see any error message. Wrapping in try-catch with user feedback and a finally block for loading state might be a better option.

title="Choose a folder"
open={true}
onOk={() => onSubmit(selectedFolders)}
onCancel={() => onSubmit([])}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not quite sure what will happen on code level if we submit it with empty array here in this case. Can you please specify what are we trying to achieve with this. Because normally, what I would have done here is to just onCancel={() => onSubmit(initialFolders)} i.e., restoring the initial state


groups[index].folders.forEach((folder) => {
if (existingFolderRoles[folder.id]) {
updates.push({ roleId: existingFolderRoles[folder.id], permissions });
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what would happen if a folder is moved from one group to another. I mean, if I have understood it correctly, when a folder X moves from group A to group B, it will be in additions for group B, but the old role from group A won't be in removals unless group A is completely empty. This could create duplicate child roles for the same folder.

@@ -132,12 +136,15 @@ export const FolderTree = <TContentType extends FolderChildren = FolderChildren>
const rootFolder = await getFolder(spaceId);
if ('error' in rootFolder) return;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Although it’s not related to the changes you made, I just noticed that the error has been silenced. Should not we at least display the error or log it?

await asyncForEach(toUpdate, async ({ roleId, permissions }) => {
await _updateRole(roleId, { permissions }, ability, trx);
});

Copy link
Copy Markdown
Contributor

@Zayn-Javed Zayn-Javed Apr 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the sequential asyncForEach for removals and updates is really unnecessary? I mean, I think they can run in parallel. what we need sequential is only the addition. So may be, we can use Promise.all([...toRemove.map(...), ...toUpdate.map(...)]) here.

}));

await addRoleMappings(roleMappings, ability, trx);
});
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If parentRole.members is empty, no mappings are created, which is correct. But if members are added to the parent role later, existing child roles would not get updated. Having said that, if I have understood it correctly (which I’m not entirely sure about) then for this case, would not we need a separate sync operation when adding members to parent roles? Is this handled elsewhere?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants