@oneuptime/common 12.0.14 → 12.0.16

package/build/dist/UI/Components/ModelTable/BaseModelTable.js

@@ -8,6 +8,7 @@ import TableFilterUrlState from "../../Utils/TableFilterUrlState";
 import TableViewUrlState from "../../Utils/TableViewUrlState";
 import buildQueryFromFilterData, { sanitizeFilterData, } from "./FilterDataToQuery";
 import PermissionUtil from "../../Utils/Permission";
+import PermissionGate, { ModelAction, } from "../../Utils/PermissionGate";
 import ProjectUtil from "../../Utils/Project";
 import User from "../../Utils/User";
 import Button, { ButtonSize, ButtonStyleType } from "../Button/Button";
@@ -87,6 +88,18 @@ const BaseModelTable = (props) => {
     const [tableView, setTableView] = useState(null);
     const matchBulkSelectedItemByField = ((_a = props.bulkActions) === null || _a === void 0 ? void 0 : _a.matchBulkSelectedItemByField) || "_id";
     const model = new props.modelType();
+    const getActionGate = (action) => {
+        const result = PermissionGate.check(model, action, {
+            singularName: props.singularName || model.singularName || undefined,
+        });
+        if (result.isAllowed) {
+            return { show: true, disabled: false, tooltip: undefined };
+        }
+        if (result.disabledReason) {
+            return { show: true, disabled: true, tooltip: result.disabledReason };
+        }
+        return { show: false, disabled: false, tooltip: undefined };
+    };
     const [bulkSelectedItems, setBulkSelectedItems] = useState([]);
     /*
      * "Select All" gets its own loading / error state instead of sharing
@@ -719,22 +732,19 @@ const BaseModelTable = (props) => {
                 Logger.warn("User does not have read permissions to read - " + moreField);
             }
         }
-        const permissions = PermissionUtil.getAllPermissions();
-        let showActionsColumn = Boolean((permissions &&
-            ((props.isDeleteable && model.hasDeletePermissions(permissions)) ||
-                (props.isEditable && model.hasUpdatePermissions(permissions)) ||
-                (props.isViewable && model.hasReadPermissions(permissions)))) ||
+        /*
+         * The column has to exist for a locked Edit / Delete button to have
+         * somewhere to live, so it follows what the table author asked for rather
+         * than what this particular viewer is allowed to do. View is the exception
+         * - a disabled "View X" on a row would confirm a record the viewer is not
+         * allowed to know about - so it still disappears without read permission.
+         */
+        const showActionsColumn = Boolean((props.isDeleteable && getActionGate(ModelAction.Delete).show) ||
+            (props.isEditable && getActionGate(ModelAction.Update).show) ||
+            (props.isViewable &&
+                PermissionGate.check(model, ModelAction.Read).isAllowed) ||
             (props.actionButtons && props.actionButtons.length > 0) ||
             props.showViewIdButton);
-        if (User.isMasterAdmin()) {
-            if ((props.actionButtons && props.actionButtons.length > 0) ||
-                props.showViewIdButton ||
-                props.isDeleteable ||
-                props.isEditable ||
-                props.isViewable) {
-                showActionsColumn = true;
-            }
-        }
         if (showActionsColumn) {
             columns.push({
                 title: tx("Actions"),
@@ -1370,23 +1380,28 @@ const BaseModelTable = (props) => {
         if (((_a = props.cardProps) === null || _a === void 0 ? void 0 : _a.buttons) && ((_b = props.cardProps) === null || _b === void 0 ? void 0 : _b.buttons.length) > 0) {
             headerbuttons = [...headerbuttons, ...props.cardProps.buttons];
         }
-        const permissions = PermissionUtil.getAllPermissions();
-        let hasPermissionToCreate = false;
-        if (permissions) {
-            hasPermissionToCreate =
-                model.hasCreatePermissions(permissions) || User.isMasterAdmin();
-        }
+        const createGate = getActionGate(ModelAction.Create);
         const showFilterButton = props.filters.length > 0;
-        // because ordered list add button is inside the table and not on the card header.
+        /*
+         * because ordered list add button is inside the table and not on the card
+         * header. Without create permission the button is shown locked rather than
+         * removed, so the user can see the action exists and read why it is not
+         * available to them.
+         */
         if (props.isCreateable &&
-            hasPermissionToCreate &&
+            createGate.show &&
             showAs !== ShowAs.OrderedStatesList) {
             headerbuttons.push({
                 title: `${tx(props.createVerb || "Create")} ${tx(props.singularName || model.singularName || "")}`,
                 buttonStyle: ButtonStyleType.NORMAL,
                 buttonSize: ButtonSize.Normal,
                 className: "",
+                disabled: createGate.disabled,
+                tooltip: createGate.tooltip,
                 onClick: () => {
+                    if (createGate.disabled) {
+                        return;
+                    }
                     if (props.onCreateClick) {
                         props.onCreateClick();
                         return;
@@ -1509,7 +1524,14 @@ const BaseModelTable = (props) => {
     };
     const getUserPermissions = () => {
         var _a, _b;
-        let userPermissions = ((_a = PermissionUtil.getGlobalPermissions()) === null || _a === void 0 ? void 0 : _a.globalPermissions) || [];
+        /*
+         * A copy - Public is appended below, and pushing into the array the util
+         * handed back mutates the snapshot every other permission check on the
+         * page reads from.
+         */
+        let userPermissions = [
+            ...(((_a = PermissionUtil.getGlobalPermissions()) === null || _a === void 0 ? void 0 : _a.globalPermissions) || []),
+        ];
         if (PermissionUtil.getProjectPermissions() &&
             ((_b = PermissionUtil.getProjectPermissions()) === null || _b === void 0 ? void 0 : _b.permissions) &&
             PermissionUtil.getProjectPermissions().permissions.length > 0) {
@@ -1612,11 +1634,13 @@ const BaseModelTable = (props) => {
                     },
                 });
             }
-            if (props.isEditable &&
-                (model.hasUpdatePermissions(permissions) || User.isMasterAdmin())) {
+            const updateGate = getActionGate(ModelAction.Update);
+            if (props.isEditable && updateGate.show) {
                 actionsSchema.push({
                     title: tx(props.editButtonText || "Edit"),
                     buttonStyleType: ButtonStyleType.OUTLINE,
+                    disabled: updateGate.disabled,
+                    tooltip: updateGate.tooltip,
                     onClick: async (item, onCompleteAction, onError) => {
                         try {
                             if (props.onBeforeEdit) {
@@ -1633,12 +1657,14 @@ const BaseModelTable = (props) => {
                     },
                 });
             }
-            if (props.isDeleteable &&
-                (model.hasDeletePermissions(permissions) || User.isMasterAdmin())) {
+            const deleteGate = getActionGate(ModelAction.Delete);
+            if (props.isDeleteable && deleteGate.show) {
                 actionsSchema.push({
                     title: tx(props.deleteButtonText || "Delete"),
                     icon: IconProp.Trash,
                     buttonStyleType: ButtonStyleType.DANGER_OUTLINE,
+                    disabled: deleteGate.disabled,
+                    tooltip: deleteGate.tooltip,
                     onClick: async (item, onCompleteAction, onError) => {
                         try {
                             if (props.onBeforeDelete) {
@@ -1777,8 +1803,17 @@ const BaseModelTable = (props) => {
                 await getFilterDropdownItems();
             }, bulkActions: (() => {
                 var _a, _b;
-                const permissions = PermissionUtil.getAllPermissions();
-                const userCanDelete = model.hasDeletePermissions(permissions);
+                const bulkDeleteGate = getActionGate(ModelAction.Delete);
+                /*
+                 * Whether to auto-add the default Delete still follows the model
+                 * check alone, exactly as it did before. Folding the master-admin
+                 * short circuit in here would grow a row-selection column onto every
+                 * table a master admin opens without project permissions - Table
+                 * derives those checkboxes from this array being non-empty - which is
+                 * a layout change nobody asked for. The gate above still decides
+                 * whether the action, once present, is locked and what it says.
+                 */
+                const userCanDelete = model.hasDeletePermissions(PermissionUtil.getAllPermissions());
                 const sourceButtons = [...((_b = (_a = props.bulkActions) === null || _a === void 0 ? void 0 : _a.buttons) !== null && _b !== void 0 ? _b : [])];
                 /*
                  * Auto-include the default Delete bulk action whenever the user has
@@ -1788,6 +1823,11 @@ const BaseModelTable = (props) => {
                  * per-row Delete button in the Actions column, not bulk operations.
                  * The confirmation modal is wired up via the schema's confirmMessage
                  * / confirmTitle below. Skip if the table author already added it.
+                 *
+                 * Only auto-inject it when the table already offers bulk actions.
+                 * Table derives the row checkboxes from this array being non-empty,
+                 * so injecting a locked Delete into an otherwise empty array would
+                 * grow a selection column onto tables that have never had one.
                  */
                 const alreadyHasDeleteAction = sourceButtons.some((action) => {
                     if (action === ModalTableBulkDefaultActions.Delete) {
@@ -1802,16 +1842,34 @@ const BaseModelTable = (props) => {
                     }
                     return false;
                 });
-                if (userCanDelete && !alreadyHasDeleteAction) {
+                const canAutoInjectDelete = userCanDelete ||
+                    (bulkDeleteGate.disabled && sourceButtons.length > 0);
+                if (canAutoInjectDelete && !alreadyHasDeleteAction) {
                     sourceButtons.push(ModalTableBulkDefaultActions.Delete);
                 }
                 return {
-                    buttons: sourceButtons.map((action) => {
-                        if (action === ModalTableBulkDefaultActions.Delete &&
-                            userCanDelete) {
-                            return getDeleteBulkAction();
+                    buttons: sourceButtons
+                        .map((action) => {
+                        if (action !== ModalTableBulkDefaultActions.Delete) {
+                            return action;
                         }
-                        return action;
+                        /*
+                         * A table author who asked for the default Delete but whose
+                         * viewer cannot delete used to leave the raw enum string in
+                         * the array, which then reached BulkUpdateForm as if it were
+                         * a button schema. Resolve it here, in every branch.
+                         */
+                        if (!bulkDeleteGate.show) {
+                            return null;
+                        }
+                        const deleteAction = getDeleteBulkAction();
+                        if (bulkDeleteGate.disabled) {
+                            return Object.assign(Object.assign({}, deleteAction), { disabled: true, tooltip: bulkDeleteGate.tooltip });
+                        }
+                        return deleteAction;
+                    })
+                        .filter((action) => {
+                        return action !== null;
                     }),
                 };
             })(), onBulkActionEnd: async () => {
@@ -1903,13 +1961,13 @@ const BaseModelTable = (props) => {
         }
         return (React.createElement(OrderedStatesList, { error: error, isLoading: isLoading, data: data, id: props.id, titleField: (_a = props.orderedStatesListProps) === null || _a === void 0 ? void 0 : _a.titleField, descriptionField: (_b = props.orderedStatesListProps) === null || _b === void 0 ? void 0 : _b.descriptionField, orderField: (_c = props.orderedStatesListProps) === null || _c === void 0 ? void 0 : _c.orderField, shouldAddItemInTheBeginning: props.orderedStatesListProps.shouldAddItemInTheBeginning, shouldAddItemInTheEnd: props.orderedStatesListProps.shouldAddItemInTheEnd, noItemsMessage: props.noItemsMessage || "", onRefreshClick: async () => {
                 await fetchItems();
-            }, onCreateNewItem: props.isCreateable
+            }, onCreateNewItem: props.isCreateable && getActionGate(ModelAction.Create).show
                 ? (order) => {
                     setOrderedStatesListNewItemOrder(order);
                     setModalType(ModalType.Create);
                     setShowModal(true);
                 }
-                : undefined, singularLabel: props.singularName || model.singularName || "Item", actionButtons: actionButtonSchema, getTitleElement: getTitleElement, getDescriptionElement: getDescriptionElement }));
+                : undefined, createDisabledReason: getActionGate(ModelAction.Create).tooltip, singularLabel: props.singularName || model.singularName || "Item", actionButtons: actionButtonSchema, getTitleElement: getTitleElement, getDescriptionElement: getDescriptionElement }));
     };
     const getList = () => {
         return (React.createElement(List, { onFilterChanged: (filterData) => {
@@ -2261,8 +2319,11 @@ const BaseModelTable = (props) => {
     const renderMainButton = (b) => {
         return (React.createElement(Button, { key: "model-table-main-action", title: b.title, buttonStyle: b.buttonStyle, buttonSize: b.buttonSize, className: b.className, onClick: () => {
                 var _a;
+                if (b.disabled) {
+                    return;
+                }
                 (_a = b.onClick) === null || _a === void 0 ? void 0 : _a.call(b);
-            }, disabled: b.disabled, icon: b.icon, shortcutKey: b.shortcutKey, dataTestId: "card-button", isLoading: b.isLoading }));
+            }, disabled: b.disabled, tooltip: b.tooltip, icon: b.icon, shortcutKey: b.shortcutKey, dataTestId: "card-button", isLoading: b.isLoading }));
     };
     /*
      * Icon-only card buttons (Refresh, Filter, …) have empty titles, so derive
@@ -2306,7 +2367,7 @@ const BaseModelTable = (props) => {
                     if (!b.disabled) {
                         (_a = b.onClick) === null || _a === void 0 ? void 0 : _a.call(b);
                     }
-                }, isDisabled: b.disabled }));
+                }, isDisabled: b.disabled, tooltip: b.tooltip }));
         });
         return (React.createElement(MoreMenu, { key: "model-table-more-menu", menuIcon: IconProp.EllipsisHorizontal, text: "" }, children));
     };
@@ -2460,7 +2521,7 @@ const BaseModelTable = (props) => {
                 props.cardProps && (React.createElement(Card, Object.assign({}, props.cardProps, { buttons: headerButtons, bodyClassName: showAs === ShowAs.List
                         ? "-ml-6 -mr-6 bg-gray-50 border-top"
                         : "", title: getCardHeaderTitle(getCardTitle(props.cardProps.title || "")) }),
-                    tableColumns.length === 0 && allColumns.length > 0 ? (React.createElement(ErrorMessage, { message: `You are not authorized to view this table. You need any one of these permissions: ${PermissionHelper.getPermissionTitles(model.getReadPermissions()).join(", ")}` })) : (React.createElement(React.Fragment, null)),
+                    tableColumns.length === 0 && allColumns.length > 0 ? (React.createElement(ErrorMessage, { message: `You are not authorized to view this table. You need any one of these permissions: ${PermissionGate.getPermissionTitles(model.getReadPermissions()).join(", ")}` })) : (React.createElement(React.Fragment, null)),
                     props.topContent || React.createElement(React.Fragment, null),
                     tableColumns.length > 0 && showAs === ShowAs.Table ? (getTable()) : (React.createElement(React.Fragment, null)),
                     tableColumns.length > 0 && showAs === ShowAs.List ? (getList()) : (React.createElement(React.Fragment, null)))),