feat: client side access control checks #27635

zlwaterfield · 2025-01-17T00:33:34Z

Changes

Follow along: #24512

This PR is adding a component that checks if the current user can perform an action on a resource under the access control model and return a reason why if not. It will disable buttons/inputs where the user does not have access and show a tooltip on hover with more information. This includes a helped component named <AccessControlledLemonButton /> that extends LemonButton to make it very easy to use.

Initially adding for the main four resources (insights, dashboards, notebooks, feature flags). The actions being blocked are being made under the assumption the user will always have access to the underlying data ,so they will still be able to duplicate, view SQL, etc. They just won't be able to action edit or delete the resource. This doesn't yet cover 100% of cases but it's covering most. It's integrating into existing patterns of canEditInsight and canEditDashboard.

Only relevant for those with the feature flag on.

👉 Stay up-to-date with PostHog coding conventions for a smoother review.

Does this work well for both Cloud and self-hosted?

Yes

How did you test this code?

Manually

github-actions · 2025-01-17T00:49:56Z

Size Change: +761 B (+0.07%)

Total Size: 1.16 MB

ℹ️ View Unchanged

Filename	Size	Change
`frontend/dist/toolbar.js`	1.16 MB	+761 B (+0.07%)

_{compressed-size-action}

posthog-bot · 2025-01-17T00:51:45Z

📸 UI snapshots have been updated

2 snapshot changes in total. 0 added, 2 modified, 0 deleted:

chromium: 0 added, 2 modified, 0 deleted (diff for shard 2)
webkit: 0 added, 0 modified, 0 deleted

Triggered by this commit.

👉 Review this PR's diff of snapshots.

benjackwhite

Some thoughts on how this could be a little more scalable as it feels quite complex atm

frontend/src/lib/components/AccessControlAction.tsx

frontend/src/scenes/feature-flags/FeatureFlags.tsx

joshsny

Looking good, left a couple of comments

frontend/src/layout/navigation-3000/sidepanel/panels/access_control/accessControlLogic.ts

frontend/src/lib/components/AccessControlAction.tsx

frontend/src/scenes/dashboard/dashboards/DashboardsTable.tsx

frontend/src/scenes/saved-insights/SavedInsights.tsx

posthog-bot · 2025-01-20T22:03:54Z

📸 UI snapshots have been updated

4 snapshot changes in total. 0 added, 4 modified, 0 deleted:

chromium: 0 added, 0 modified, 0 deleted
webkit: 0 added, 4 modified, 0 deleted (diff for shard 2)

Triggered by this commit.

👉 Review this PR's diff of snapshots.

joshsny

LGTM 🚢

joshsny · 2025-01-21T15:16:56Z

frontend/src/scenes/feature-flags/FeatureFlag.tsx

+                                                    <AccessControlledLemonButton
+                                                        userAccessLevel={featureFlag.user_access_level}
+                                                        minAccessLevel="editor"
+                                                        resourceType="feature flag"


nit(non-blocking): resourceType is free text for inserting into the disabledReason, but it's also passed to accessLevelSatisfied where it needs to be correct. may be worth considering an enum or string literal

I was about to say the same - resourceType should be a proper typed enum to match what the backend has. I don't think feature flag is actually correct?

Yeah, resource type is irrelevant to the checks right now other than project and org, but that's a good point. I'll make a change

posthog-bot · 2025-01-21T17:53:28Z

📸 UI snapshots have been updated

1 snapshot changes in total. 0 added, 1 modified, 0 deleted:

chromium: 0 added, 1 modified, 0 deleted (diff for shard 1)
webkit: 0 added, 0 modified, 0 deleted

Triggered by this commit.

👉 Review this PR's diff of snapshots.

benjackwhite

Generally great - just the typed resource needed

benjackwhite · 2025-01-22T09:43:21Z

frontend/src/lib/components/AccessControlledLemonButton.tsx

+    children,
+    ...props
+}: AccessControlledLemonButtonProps): JSX.Element => {
+    return (


this is great

frontend/src/scenes/dashboard/dashboardLogic.tsx

benjackwhite · 2025-01-22T09:44:57Z

frontend/src/scenes/feature-flags/FeatureFlag.tsx

+                                                    <AccessControlledLemonButton
+                                                        userAccessLevel={featureFlag.user_access_level}
+                                                        minAccessLevel="editor"
+                                                        resourceType="feature flag"


I was about to say the same - resourceType should be a proper typed enum to match what the backend has. I don't think feature flag is actually correct?

Twixes

Some minor Storybook staleness, but overall looking solid

frontend/__snapshots__/scenes-app-insights--trends-bar--light--webkit.png

posthog-bot · 2025-01-22T11:11:49Z

📸 UI snapshots have been updated

1 snapshot changes in total. 0 added, 1 modified, 0 deleted:

chromium: 0 added, 1 modified, 0 deleted (diff for shard 1)
webkit: 0 added, 0 modified, 0 deleted

Triggered by this commit.

👉 Review this PR's diff of snapshots.

posthog-bot · 2025-01-22T11:31:12Z

📸 UI snapshots have been updated

1 snapshot changes in total. 0 added, 1 modified, 0 deleted:

chromium: 0 added, 1 modified, 0 deleted (diff for shard 1)
webkit: 0 added, 0 modified, 0 deleted

Triggered by this commit.

👉 Review this PR's diff of snapshots.

zlwaterfield · 2025-01-22T16:39:20Z

CI pased - halleluwah

Others approved and nee to get this out

Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Michael Matloka <[email protected]>

zlwaterfield self-assigned this Jan 17, 2025

zlwaterfield added 4 commits January 16, 2025 16:36

Update can edit logic

12205d1

add action access control action comp

d3c7a6b

implement access control action checks

473fc6b

move insight perm to basic serializer

580b445

zlwaterfield force-pushed the zach/rbac/6d branch from fb9e3c8 to 580b445 Compare January 17, 2025 00:37

zlwaterfield requested review from benjackwhite, Twixes and a team January 17, 2025 00:42

zlwaterfield changed the title ~~pull our open panel cta~~ feat: client side access control checks Jan 17, 2025

Update UI snapshots for chromium (2)

c5fd46e

benjackwhite reviewed Jan 17, 2025

View reviewed changes

frontend/src/lib/components/AccessControlAction.tsx Outdated Show resolved Hide resolved

frontend/src/scenes/feature-flags/FeatureFlags.tsx Outdated Show resolved Hide resolved

joshsny reviewed Jan 17, 2025

View reviewed changes

zlwaterfield added 3 commits January 20, 2025 16:31

Move to a better access controlled button

6a31105

put back dashboard delete wrapper

48eb0e8

put back ff disabled checks

df35d12

zlwaterfield mentioned this pull request Jan 20, 2025

Unified role-based access control (RBAC) #24512

Open

19 tasks

Update UI snapshots for webkit (2)

6510905

zlwaterfield force-pushed the zach/rbac/6d branch from d776f6f to 6510905 Compare January 21, 2025 00:34

zlwaterfield added 3 commits January 20, 2025 19:36

Merge remote-tracking branch 'origin/master' into zach/rbac/6d

15dc37c

Add user access control to basic serializer return

cccb942

Update snapshot

b954048

zlwaterfield requested review from benjackwhite and joshsny January 21, 2025 14:54

joshsny approved these changes Jan 21, 2025

View reviewed changes

zlwaterfield and others added 2 commits January 21, 2025 12:35

Merge branch 'master' into zach/rbac/6d

1c11008

Update UI snapshots for chromium (1)

a491cb8

zlwaterfield added 5 commits January 21, 2025 15:27

Clean up can edit logic

81959c3

Update insightLogic.tsx

8a2f10c

Merge branch 'master' into zach/rbac/6d

94d85a9

LINT

e843246

comment out edit changes

938d40a

benjackwhite previously requested changes Jan 22, 2025

View reviewed changes

Clarify mixin user_access_control comment

c20647a

Twixes approved these changes Jan 22, 2025

View reviewed changes

frontend/__snapshots__/scenes-app-insights--trends-bar--light--webkit.png Outdated Show resolved Hide resolved

Update UI snapshots for chromium (1)

39accd1

Update UI snapshots for chromium (1)

1350a53

zlwaterfield added 4 commits January 22, 2025 09:34

update default access levels

0801f2e

update to use enum for resource types

e850919

Merge remote-tracking branch 'origin/master' into zach/rbac/6d

60c354d

update to use enum

883ea6d

zlwaterfield requested a review from benjackwhite January 22, 2025 16:38

Merge branch 'master' into zach/rbac/6d

c2f04fc

zlwaterfield merged commit 856e731 into master Jan 22, 2025
99 checks passed

zlwaterfield deleted the zach/rbac/6d branch January 22, 2025 20:41

timgl pushed a commit that referenced this pull request Jan 28, 2025

feat: client side access control checks (#27635)

0233fbb

Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Michael Matloka <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: client side access control checks #27635

feat: client side access control checks #27635

zlwaterfield commented Jan 17, 2025 •

edited

Loading

github-actions bot commented Jan 17, 2025 •

edited

Loading

posthog-bot commented Jan 17, 2025

benjackwhite left a comment

joshsny left a comment

posthog-bot commented Jan 20, 2025

joshsny left a comment

joshsny Jan 21, 2025 •

edited

Loading

benjackwhite Jan 22, 2025

zlwaterfield Jan 22, 2025

posthog-bot commented Jan 21, 2025

benjackwhite left a comment

benjackwhite Jan 22, 2025

benjackwhite Jan 22, 2025

Twixes left a comment

posthog-bot commented Jan 22, 2025

posthog-bot commented Jan 22, 2025

zlwaterfield commented Jan 22, 2025

feat: client side access control checks #27635

feat: client side access control checks #27635

Conversation

zlwaterfield commented Jan 17, 2025 • edited Loading

Changes

Does this work well for both Cloud and self-hosted?

How did you test this code?

github-actions bot commented Jan 17, 2025 • edited Loading

posthog-bot commented Jan 17, 2025

📸 UI snapshots have been updated

benjackwhite left a comment

Choose a reason for hiding this comment

joshsny left a comment

Choose a reason for hiding this comment

posthog-bot commented Jan 20, 2025

📸 UI snapshots have been updated

joshsny left a comment

Choose a reason for hiding this comment

joshsny Jan 21, 2025 • edited Loading

Choose a reason for hiding this comment

benjackwhite Jan 22, 2025

Choose a reason for hiding this comment

zlwaterfield Jan 22, 2025

Choose a reason for hiding this comment

posthog-bot commented Jan 21, 2025

📸 UI snapshots have been updated

benjackwhite left a comment

Choose a reason for hiding this comment

benjackwhite Jan 22, 2025

Choose a reason for hiding this comment

benjackwhite Jan 22, 2025

Choose a reason for hiding this comment

Twixes left a comment

Choose a reason for hiding this comment

posthog-bot commented Jan 22, 2025

📸 UI snapshots have been updated

posthog-bot commented Jan 22, 2025

📸 UI snapshots have been updated

zlwaterfield commented Jan 22, 2025

zlwaterfield commented Jan 17, 2025 •

edited

Loading

github-actions bot commented Jan 17, 2025 •

edited

Loading

joshsny Jan 21, 2025 •

edited

Loading