Repository navigation
feat(console): lock role-gated actions instead of hiding or disabling them - #194
Merged
Merged
Conversation
… them Enrollment's New enrollment and LINK approve, the profile catalog's Delete profile, the per-node ACME/EST switch, node Config apply, node profile Reconcile, and node Issue/Re-key now use the kit's Button lockedReason prop when the signed-in operator's level can't use them, instead of a native disabled button or a hidden control. Each stays focusable and explains the role it needs; the server-side checks are unchanged. Issue and Re-key had no client-side gate at all even though the manager requires operator level for both (RekeyNode, IssueLeaf); a viewer only found out on submit. They now lock the same way as the rest. Tests that asserted toBeDisabled()/a hidden control for these gates now assert the locked aria-disabled/lockedReason state instead. Refs #183 Signed-off-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>
Bugs5382
marked this pull request as ready for review
October 15, 2026 20:15
4 tasks done
Bugs5382
added a commit
that referenced
this pull request
Oct 15, 2026
…g them (#197) Extends #194's lock pattern to the actions it didn't cover: profile-form's Save, node-chain-validate's Validate, node-image-lifecycle's Stage/Activate/ Roll back, operators' request/record/complete/cancel/deny, adopt's Preview (the wizard's one entry point), root-detail's Rename, node-detail-panel's Rename/Export key/Import key/Decommission/Reboot, and the SCEP challenge and enrolment mint/revoke/approve/reject actions. Every one of these was either hidden entirely for a role that lacks it, or replaced by a disabled control or a "read-only"/"requires X level" note. They now show the kit's Button lockedReason, or RoleGate for the few that are plain table-row buttons rather than the kit's Button (operators' Deny, Complete and Cancel) -- RoleGate needed a TooltipProvider the console had never wired up for this purpose, so this adds one locally around the Operators page, plus the ResizeObserver stub its Radix Tooltip content needs under jsdom, mirroring the one the UI kit's own test setup already has. Adopt's admin gate used to replace the whole page with a one-line notice; it now renders the real wizard with its endpoint field disabled and its Preview button locked, since nothing past Preview is reachable without it anyway -- the same "no route or server behaviour changes" rule as the rest of this pass. Every test that asserted a hidden or disabled control for one of these now asserts the locked aria-disabled/lockedReason state instead, named in each with a short comment on why it moved, same as #194. No route, permission check or server-side behaviour changes here either; this is presentation only. Refs #196 Signed-off-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com> Co-authored-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Every action the signed-in operator's level can't use now shows the kit's lock pattern (a
lock icon, aria-disabled, still focusable, with a reason a screen reader announces) instead of a
plain disabled button or a hidden control:
a LINK request needs admin)
showing "admin only" text)
the button)
operator level for both (RekeyNode, IssueLeaf) -- a viewer only found out after submitting.
They now lock the same way as the rest.
No route, permission check or server-side behaviour changes; this is presentation only.
I rebased onto main after #192 landed rather than stacking, since #192 touched the first-run
wizard and the credential-request page. Neither of those screens turned out to have a role gate
to convert (their "level" field is the level being requested, not a gate on the signed-in
operator), so there was nothing left to do there for this issue.
Every test that asserted toBeDisabled() or a hidden control for one of these gates now asserts
the locked aria-disabled/lockedReason state instead -- an intentional behaviour change, named in
each test with a short comment on why it moved.
Refs #183
Verification
How this was verified
npm run lint(eslint + prettier --check): clean.npm run testacross all workspaces: 788 console + 247 ui tests pass, including the axe checkon every page and component touched here.
npm run buildacross all workspaces: tsc + vite build succeed for console, tsc succeeds for ui.node --test scripts/*.test.mjsandnode scripts/check-release-bundle.mjs apps/console/dist:release bundle clean, no dev-only markers.
docs page to update beyond the kit's existing Button/RoleGate doc comments.