feat: Only show "Team Settings" menu for users with teamEditor role
#2693
Conversation
DafyddLlyr
changed the title
teamEditor roleteamEditor role
|
Removed vultr server and associated DNS entries |
There was a problem hiding this comment.
Working as expected for me on the pizza with regard to hiding of the settings link 👍
As you mentioned I can still access the route but I see that's on the TODO.
Although I was surprised that I think the Hasura permissions still allowed me to edit the forms when I believe I was just a TeamViewer.
I was also able to update other teams design settings.
My user permissions:
"is_platform_admin": false,
"is_staging_only": false,
"teams": [
{
"role": "teamEditor",
"team": {
"slug": "templates"
}
},
{
"role": "teamViewer",
"team": {
"slug": "doncaster"
}
}
]
Is that expected behaviour or maybe I'm making a mistake locally?
I think this will effectively be resolved with the guard clauses I was just surprised 🤔
Sorry @DafyddLlyr I didn't realised this had been swapped to draft. |
|
🤖 Hasura Change Summary compared a subset of table metadata including permissions: Updated Tables (1)
|
| const isAuthorised = useStore.getState().canUserEditTeam(req.params.team); | ||
| if (!isAuthorised) | ||
| throw new NotFoundError( | ||
| `User does not have access to ${req.originalUrl}`, | ||
| ); |
There was a problem hiding this comment.
I noticed that this was missing and picked up the fix here. On staging and prod you can navigate to <flow>/settings without the proper permissions.
| const isFlowSettingsVisible = | ||
| route.data.flow && !route.data.flow && canUserEditTeam(team.slug); | ||
|
|
||
| const isTeamSettingsVisible = | ||
| route.data.team && !route.data.flow && canUserEditTeam(team.slug); | ||
|
|
||
| const isGlobalSettingsVisible = | ||
| !route.data.flow && !team.slug && user?.isPlatformAdmin; |
There was a problem hiding this comment.
A few related fixes / tidy ups to the change made in this PR , apologies for polluting things a little.
| filter: | ||
| team: | ||
| members: | ||
| _and: | ||
| - user_id: | ||
| _eq: x-hasura-user-id | ||
| - role: | ||
| _eq: teamEditor |
There was a problem hiding this comment.
This equates to "teams where the user is a teamEditor"
|
@Mike-Heneghan Thanks for taking a look - things should now be resolved 👍 |
What does this PR do?
teamEditororplatformAdminroles<team>/settings<team>/<flow>/settingsand/global-settingas these were previously missedteamEditorroleIf we decide we want / need a
teamAdminrole we can add one in future but this seems fine to me for the momentTeamEditor
Not TeamEditor
