Open
Conversation
Introduce client-side RBAC support and apply it across the Epinio dashboard. Add utils/permissions.ts to build a flat permission map from /api/v1/me roles, and new EpinioMe/EpinioRole types. Extend the epinio store with a me action, permissions state, a can getter helper, and related mutations/reset. Fetch /me on relevant pages (namespaces, applications) and conditionally show Create buttons only when appropriate permissions are present (with sensible defaults while permissions are not yet loaded). Update resource models (applications, namespaces, services, configurations) to filter available actions based on the can getter and prune orphaned dividers for application actions. Overall this enforces UI-level RBAC while still relying on the API for authoritative enforcement.
- config: isCreatable false for Configuration/Service; Create only when canCreateConfiguration/canCreateService - configurations.vue: masthead + RBAC-gated Create button - services.vue: strict canCreateService (hide when no service_write) - applications: gate shell by app_exec, Edit/ViewConfig by app_update and configuration_read/write - permissions: add configuration and service actions to role definitions - index.ts: markRaw for ThemeToggle and UnsavedChangesDialog (Vue warning fix)
- Hide "Edit Config" in view mode when user lacks configuration_write/configuration - Hide Shell action for users without app_exec (e.g. view_only) - Add .hide-edit-config CSS when button should be hidden.
- Always hide the primary "Edit Config" footer button in the applications edit dialog when the user lacks configuration write permissions, regardless of view vs edit mode. - Restrict the "Edit Config" menu action so it is only shown to users who have configuration write permissions. - Add a canEdit getter on the application model so the Resource Detail drawer only shows "Edit Config" when the user can actually modify configuration. - Tighten logic for the "Create Application" button so it is only shown when loaded permissions confirm the user has app create/write capabilities, keeping it hidden for view-only users.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Checklist
Summary
Fixes #
Implements RBAC-aware UI for the Epinio dashboard. The UI fetches the current user's permissions from
/api/v1/me, maps roles to action permissions, and conditionally shows or hides Create buttons and action-menu items (Edit, Delete, Show Configuration) based on those permissions.Occurred changes and/or fixed issues
utils/permissions.ts(new): Maps role IDs to action IDs (ROLE_ACTIONS),buildPermissionsFromRoles()for the storeepinio-store/): Addedmeaction,permissionsandcangetters,me/permissions/resetmutations; fetches/api/v1/meon loadtypes.ts): AddedEpinioRoleandEpinioMeinterfaces_availableActionsoverrides inapplications.js,configurations.js,namespaces.js,services.jsto filter actions bycan()checksepinio/meon mount; Create buttons are shown only whencanCreateApp/canCreateNamespaceis trueTechnical notes summary
Areas or cases that should be tested
Areas which could experience regressions
me.rolesviabuildPermissionsFromRoles(); role IDs likeepinio-role-application-managerare normalized toapplication_managercangetter checks the permission map; models use it to filter_availableActions(Edit, Delete, Show Configuration)resetmutation clearsmeandpermissionson store reset (e.g. logout/navigation away)Screenshot/Video