Skip to content

feat: Add Access Control settings panel with roles, policies, and permissions debugger - #33272

Open
Rohit0301 wants to merge 26 commits into
mainfrom
settings-access-control-nav-fix
Open

Rohit0301 wants to merge 26 commits into
mainfrom
settings-access-control-nav-fix

Conversation

@Rohit0301

Copy link
Copy Markdown
Contributor

Describe your changes:

Fixes #

I worked on adding a full Access Control settings panel to the user Profile page because the platform lacked a unified UI for managing roles, policies, and permissions. This includes role/policy CRUD, an audit log viewer, and a permission debugger.

Type of change:

  • New feature

High-level design:

New components under Profile/tabs/access-control/:

  • AccessControlPanel — top-level router/nav (breadcrumbs, header actions) driven by a discriminated-union AccessControlView type
  • AccessControlRolesPanel / AccessControlPoliciesPanel — list views with search, create, delete
  • AccessControlRoleDetail / AccessControlPolicyDetail — detail views with inline rename, description editing, rule management, and role/team/user association tables
  • AccessControlAddRoleForm / AccessControlAddPolicyForm — creation forms
  • AccessControlAuditLogsPanel / AccessControlAuditLogFilters — refactored audit log viewer integrated into the settings panel
  • AccessControlDebuggerPanel — permission evaluation debugger (evaluate any user+resource+operation)
  • AccessControlUserPermissions — per-user permission breakdown (direct roles, team permissions, inherited)
  • AccessControlRuleForm — rule editor with resource/operation/condition fields
  • AccessControlLanding — entry-point landing card grid

Supporting additions:

  • 4 new SVG icons (audit-logs, permission-debugger, policy, role) + React wrappers
  • AccessControl.types.ts, .constants.ts, .utils.ts — shared types, constants, link utilities
  • i18n keys added across all 20 locale files
  • AuditLogList fully rewritten using @openmetadata/ui-core-components (removes legacy Less styles)
  • Playwright E2E test suite (AccessControlSettings.spec.ts, 1484 lines) covering roles, policies, audit logs, and permissions debugger

Tests:

Use cases covered

  • Admin can view, create, rename, and delete roles and policies
  • Admin can add/remove rules (with resource, operation, effect, condition) on a policy
  • Admin can add/remove policies on a role, and users/teams on a role
  • Permission debugger evaluates effective permissions for any user+resource+operation
  • Audit log viewer filters by entity type, user, and date range
  • Per-user permission breakdown shows direct roles, team permissions, and inherited permissions

Unit tests

  • AccessControlAddPolicyForm.test.tsx
  • AccessControlAddRoleForm.test.tsx
  • AccessControlDebuggerPanel.test.tsx
  • AccessControlPolicyDetail.test.tsx
  • AccessControlRoleDetail.test.tsx
  • AuditLogList.test.tsx (updated)
  • profileNavConfig.test.tsx (updated)

Backend integration tests

  • Not applicable (no backend API changes).

Ingestion integration tests

  • Not applicable (no ingestion changes).

Playwright (UI) tests

  • playwright/e2e/Features/AccessControlSettings.spec.ts — full CRUD and navigation coverage

Manual testing performed

N/A — covered by Playwright E2E suite.

UI screen recording / screenshots:

Not applicable.

Checklist:

  • I have read the CONTRIBUTING document.
  • My PR title is Fixes <issue-number>: <short explanation>
  • My PR is linked to a GitHub issue via Fixes #<issue-number> above.
  • I have commented on my code, particularly in hard-to-understand areas.
  • For JSON Schema changes: I updated the migration scripts or explained why it is not needed.
  • For UI changes: I attached a screen recording and/or screenshots above.
  • I have added tests (unit / integration / Playwright as applicable) and listed them above.

Rohit0301 and others added 15 commits September 10, 2026 23:20
- Add AccessControlPanel to profile nav config with breadcrumb override support
- Extend ProfileContentHeader to accept custom breadcrumbs and onBreadcrumbAction
- Add headerOverride state in ProfilePage so panels can control header title/breadcrumbs
- Clear override on nav-item switch; adjust content area layout for access-control tab
- Fix AuditLogList container width (tw:w-full)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

❌ PR checklist incomplete

This PR cannot be merged until the following are addressed on its linked issue:

  • No GitHub issue is linked. Link an issue in the Development section of the PR (or add Fixes #12345 to the description). For a same-org cross-repo issue, add Fixes open-metadata/<repo>#123 to the description.

The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically.

Maintainers can bypass this check by adding the skip-pr-checks label.

@github-actions github-actions Bot added the UI UI specific issues label Sep 14, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Hi there 👋 Thanks for your contribution!

The OpenMetadata team will review the PR shortly! Once it has been labeled as safe to test, the CI workflows
will start executing and we'll be able to make sure everything is working as expected.

Let us know if you need any help!

…n index

Keep both access-control (administration group) and custom-properties
(workspace group) nav items. Adopt selfContainedLayout pattern from main
for both panels. Merge ProfileContentHeader to support titleInput,
titleSuffix (access-control rename UX) and iconNode (custom-properties
dynamic icon) props simultaneously. Restore AuditLogs icon export in
ui-core-components index.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

Hi there 👋 Thanks for your contribution!

The OpenMetadata team will review the PR shortly! Once it has been labeled as safe to test, the CI workflows
will start executing and we'll be able to make sure everything is working as expected.

Let us know if you need any help!

@github-actions

Copy link
Copy Markdown
Contributor

🔄 Playwright impact map auto-refreshed

This PR touched specs or UI source that changed the source→spec routing map. I regenerated .github/playwright/impact-map.generated.json and pushed the diff to this branch.

- source entries: 773 → 787
- 14 added, 0 removed, 27 changed spec-list

New source→spec entries:
  openmetadata-ui/src/main/resources/ui/src/components/AuditLog/AuditLogFilters.component.tsx
  openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/ProfileContentHeader.tsx
  openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlAddPolicyForm.tsx
  openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlAddRoleForm.tsx
  openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlAuditLogFilters.tsx
  openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlAuditLogsPanel.tsx
  openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlDebuggerPanel.tsx
  openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlLanding.tsx
  openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlPanel.tsx
  openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlPoliciesPanel.tsx
  … and 4 more

Entries whose spec list changed:
  openmetadata-ui/src/main/resources/ui/playwright/constant/config.ts
  openmetadata-ui/src/main/resources/ui/playwright/constant/permission.ts
  openmetadata-ui/src/main/resources/ui/playwright/e2e/Utils/appMode.ts
  openmetadata-ui/src/main/resources/ui/playwright/support/access-control/PoliciesClass.ts
  openmetadata-ui/src/main/resources/ui/playwright/support/access-control/RolesClass.ts
  openmetadata-ui/src/main/resources/ui/playwright/support/fixtures/base.ts
  openmetadata-ui/src/main/resources/ui/playwright/utils/common.ts
  openmetadata-ui/src/main/resources/ui/playwright/utils/entity.ts
  openmetadata-ui/src/main/resources/ui/playwright/utils/roles.ts
  openmetadata-ui/src/main/resources/ui/src/components/DataAssets/AssetsSelectionModal/AssetSelectionContentBody.tsx
  … and 17 more

What is this file? It is the auto-generated half of Playwright's PR planner. It routes "if source X changes, run specs Y" by walking spec imports and cross-referencing getByTestId strings. Hand-authored routing in impact-map.json always wins on conflict.

What if I want to regenerate locally instead? Run this before pushing your next change to skip the bot commit:

python3 .github/scripts/generate_playwright_impact_map.py
git add .github/playwright/impact-map.generated.json
git commit --amend --no-edit  # or a separate commit

@github-actions

Copy link
Copy Markdown
Contributor

Hi there 👋 Thanks for your contribution!

The OpenMetadata team will review the PR shortly! Once it has been labeled as safe to test, the CI workflows
will start executing and we'll be able to make sure everything is working as expected.

Let us know if you need any help!

@Rohit0301 Rohit0301 added the safe to test Add this label to run secure Github workflows on PRs label Sep 14, 2026
Comment thread openmetadata-ui/src/main/resources/ui/playwright/utils/roles.ts
@github-actions

github-actions Bot commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

⚠️ UI Checkstyle passed — lint findings in changed files

🔍 ESLint findings in this PR's files — 0 error(s), 9 warning(s)

Errors block the build. Warnings do not yet — they are rules whose backlog is still
being worked down, listed so this PR does not add to it. See docs/ui-code-quality-gate.md.

0 error(s), 9 warning(s) across 5 changed file(s).

Count Rule
4 react-hooks/exhaustive-deps
4 openmetadata-imports/review-sequential-api-calls
1 openmetadata-imports/no-internal-barrel-imports
All findings
Location Rule Message
🟡 src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlAuditLogFilters.tsx:65:5 react-hooks/exhaustive-deps React Hook useMemo has an unnecessary dependency: 't'. Either exclude it or remove the dependency array.
🟡 src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlDebuggerPanel.tsx:57:23 react-hooks/exhaustive-deps React Hook useCallback received a function whose dependencies are unknown. Pass an inline function instead.
🟡 src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlPolicyDetail.tsx:607:9 openmetadata-imports/review-sequential-api-calls Review these sequential API requests. If they are independent, start them together with Promise.all/Promise.allSettled; keep sequencing only when data-dependent
🟡 src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlPolicyDetail.tsx:645:9 openmetadata-imports/review-sequential-api-calls Review these sequential API requests. If they are independent, start them together with Promise.all/Promise.allSettled; keep sequencing only when data-dependent
🟡 src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlPolicyDetail.tsx:808:6 react-hooks/exhaustive-deps React Hook useCallback has a missing dependency: 'onRename'. Either include it or remove the dependency array. If 'onRename' changes too often, find the parent
🟡 src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlRoleDetail.tsx:479:6 react-hooks/exhaustive-deps React Hook useCallback has a missing dependency: 'onRename'. Either include it or remove the dependency array. If 'onRename' changes too often, find the parent
🟡 src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlRoleDetail.tsx:645:9 openmetadata-imports/review-sequential-api-calls Review these sequential API requests. If they are independent, start them together with Promise.all/Promise.allSettled; keep sequencing only when data-dependent
🟡 src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlRoleDetail.tsx:681:9 openmetadata-imports/review-sequential-api-calls Review these sequential API requests. If they are independent, start them together with Promise.all/Promise.allSettled; keep sequencing only when data-dependent
🟡 src/pages/AuditLogsPage/AuditLogsPage.tsx:30:1 openmetadata-imports/no-internal-barrel-imports Import the internal module directly instead of its index barrel so unrelated siblings do not enter the bundle graph.

Fix locally (fast - only checks files changed in this branch):

make ui-checkstyle-changed

@gitar-bot

gitar-bot Bot commented Sep 15, 2026

Copy link
Copy Markdown
Code Review ✅ Approved 8 resolved / 8 findings

Comprehensive Access Control settings panel adding unified CRUD for roles, policies, and permissions with audit log viewer and debugger. Seven issues were resolved: rule condition validation, condition options filtering, React key usage, header icon rendering, header-override consistency, debug logging, and silent element-not-found handling in pagination. No open findings.

✅ 8 resolved
Performance: Rule condition validated via API on every keystroke

📄 openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlRuleForm.tsx:245-259 📄 openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlRuleForm.tsx:413-427
In AccessControlRuleForm, the condition ComboBox's onInputChange calls handleConditionValidation(value) for every character typed, firing a validateRuleCondition network request per keystroke. Besides the request storm, the calls are not sequenced or cancelled, so a slow response for an earlier value can resolve after a newer one and leave validationError/isValidCondition reflecting stale input. Debounce the validation call (e.g. 300ms, matching the existing search debounce pattern) and guard against out-of-order responses by ignoring results whose condition no longer matches the current input.

Bug: Condition options list narrows permanently while typing

📄 openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlRuleForm.tsx:235-243
handleConditionSearch filters conditionOptions from its own previous (already-filtered) state rather than from the full buildConditionOptions(policyFunctions) list. As the user types, the option set can only shrink; backspacing to a broader (but still non-empty) query never restores the removed options, so valid suggestions disappear. Filter against the full list derived from policyFunctions each time instead of the previous state.

Quality: uniqueId() used as React key during render

📄 openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/tabs/access-control/AccessControlRolesPanel.tsx:182-196
renderPolicyItem computes const key = uniqueId(); on every render and uses it as the React key. Because a fresh id is generated on each render, React cannot reconcile these nodes and remounts them every time, defeating list diffing. Use a stable key derived from the policy (e.g. policy.id ?? policy.fullyQualifiedName ?? policy.name).

Bug: Custom Properties header icon (iconNode) never rendered

📄 openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/ProfilePage.tsx:187 📄 openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/ProfilePage.tsx:212-222 📄 openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/profileNavConfig.tsx:75-82 📄 openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/profileNavConfig.tsx:177-179
CustomPropertiesPanel pushes its dynamic, entity-specific icon up through onHeaderChange under the iconNode key (using the new HeaderOverride type). But ProfilePage reads headerOverride?.icon (the ProfileHeaderOverride shape used by AccessControlPanel) and never forwards iconNode to ProfileContentHeader — even though ProfileContentHeader now accepts an iconNode prop. As a result the computed entity icon is silently dropped and the header always shows the static Settings02 nav icon regardless of subView. The two divergent override shapes (HeaderOverride with iconNode vs ProfileHeaderOverride with icon) also make the onHeaderChange={onHeaderChange} wiring in profileNavConfig a type mismatch. Unify the shapes and forward the icon: read headerOverride?.iconNode and pass it as iconNode to ProfileContentHeader.

Quality: Redundant/inconsistent header-override reset on tab switch

📄 openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/ProfilePage.tsx:102-105 📄 openmetadata-ui/src/main/resources/ui/src/components/discovery/personal-space/Profile/ProfilePage.tsx:176-181
The new useEffect resets the header via setHeaderOverride({}) on selectedId change, while handleNavSelect (the only thing that changes selectedId) already resets it to null. This is a redundant second reset, and the two use different sentinel values ({} vs null). Since the state is typed ProfileHeaderOverride | null, passing {} (which lacks the required breadcrumbs/title/description/icon fields) is also type-inconsistent. Drop one of the two resets and use null consistently.

...and 3 more resolved from earlier reviews

Review coverage

Rules No rules evaluated

Functional validation Not enabled · Set up

Auto-approval Not enabled · Set up

Options

Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Compact
gitar display:verbose         

Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source

@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

safe to test Add this label to run secure Github workflows on PRs UI UI specific issues

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant