[CHAIN] feat(ui): add Registry permission support

[Alan-TheGentleman]

🔗 Part of Chained PRs

Field	Value
Feature Branch	feat/prowler-2414-registry-ui
Main PR	#12494
Position	1 of 8
Base	feat/prowler-2414-registry-ui
Depends on	None
Follow-up	#12497, fresh Registry access authority
Review budget	237 / 400 changed lines
Starts at	Draft Registry tracker with no feature behavior
Ends with	Cloud role and session models represent Registry permission safely

Chain Overview

feat/prowler-2414-registry-ui (#12494 tracker)
└── 📍 #12495 PR 1: permissions and flag typing
    └── #12497 PR 2: fresh access authority
        └── ... PR 8: acceptance hardening
            └── #12494 tracker -> master

Scope

• Includes: exact-boolean manage_registry propagation through Cloud roles, auth/session models, UI permission metadata, false defaults, and local UI_REGISTRY_ENABLED typing.
• Excludes: Registry navigation, routes, eligibility evaluation, runtime-config exposure, API calls, credential handling, catalog UI, backend changes, and deployment changes.

Autonomy

• Focused tests and exact results are recorded.
• Runtime verification is not applicable because this slice exposes no Registry UI or route.
• Rollback is the single child commit and excludes unrelated work.
• The diff contains only this work unit.

Context

The Registry UI must fail closed and remain hidden until later slices add fresh Cloud, runtime-flag, and permission checks. This first slice introduces only the permission and configuration representation that those guards will consume.

Keeping this foundation separate makes role/session behavior reviewable before any Registry route or API integration exists.

Description

• Add manage_registry to the existing user, role, auth, and permission models with false defaults.
• Copy the permission from the current role only when its value is exactly true.
• Allow Cloud role create and edit flows to grant and retain the permission while non-Cloud payloads omit it.
• Add UI_REGISTRY_ENABLED environment typing without enabling or exposing Registry.
• Preserve existing Integrations, Billing, and generic navigation permission behavior.

No npm dependency, backend endpoint, migration, public runtime-config field, Registry route, or user-visible Registry workflow is introduced.

Steps to review

1. Review the exact-boolean and false-default propagation across auth, roles, schemas, and permission display helpers.
2. Confirm Cloud role create/edit payloads include manage_registry and non-Cloud payloads omit it.
3. Confirm UI_REGISTRY_ENABLED is typed but is not consumed to expose Registry UI.
4. Run cd ui && pnpm exec vitest run --project unit actions/auth/auth.test.ts auth.config.test.ts types/formSchemas.test.ts actions/roles/roles.test.ts components/roles/workflow/forms/add-role-form.test.tsx components/roles/workflow/forms/edit-role-form.test.tsx components/layout/app-sidebar/navigation-config.test.ts lib/helper.test.ts lib/permissions.test.ts lib/runtime-env.test.ts and verify 123 tests pass.
5. Run cd ui && pnpm run typecheck and cd ui && pnpm run test:unit; the recorded results are PASS and 3,047 passing unit tests.

Checklist

Community Checklist

• This feature/issue is listed in the open issues or roadmap.prowler.com
• Is it assigned to me, if not, request it via the open issues or Prowler Community Slack
• I have reviewed the open pull requests and confirmed there is no existing PR that implements the same outcome

• Review if the code is being covered by tests.
• Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
• Review if backport is needed.
• Review if is needed to change the README.md: not required for this foundation slice.
• Ensure a changelog fragment is added under prowler/changelog.d/, if applicable: SDK/CLI is not changed.

SDK/CLI

• Are there new checks included in this PR? No

UI

• All issue/task requirements work as expected on the UI: the complete user-facing workflow is delivered by later child PRs.
• This PR adds or updates no npm dependencies.
• Mobile screenshots/video are not applicable because this slice exposes no UI.
• Tablet screenshots/video are not applicable because this slice exposes no UI.
• Desktop screenshots/video are not applicable because this slice exposes no UI.
• No UI changelog fragment is added for this internal foundation slice; the PR uses no-changelog, and the user-visible slice will add the feature fragment.

API

• The API is not changed by this PR.
• Endpoint output, query analysis, performance evidence, API specs, versions, and API changelog are not applicable.

MCP Server

• The MCP Server is not changed by this PR.
• The MCP changelog is not applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3a4e0f97-ed2a-4082-a5c2-af080c300e3a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pfe-nazaries]

Should this env var be seteable also in runtime?

[alejandrobailo]

Consolidated into #12494. All changes are preserved there. GitHub marked this PR as merged when its commits were pushed to the parent branch; #12494 remains open and has not been merged into master.