Skip to content

feat(client): User permission set correctly also if user is not present on the 1st page of pagination in app/engine settings #1205

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 11 commits into from
Jun 5, 2025

Conversation

pallabi2303
Copy link
Contributor

Description

The logged-in user's permission is determined by a dedicated API call, ensuring correct access rights are set even if the user does not appear on the first page of the members list. This guarantees accurate UI controls regardless of pagination.

Changes Made

  1. Added a dedicated API call to fetch the logged-in user's member record directly, using their user ID and a limit of 1.

  2. Implemented the setUserDetails function to set the logged-in user's data and permission based on the result of this
    dedicated API call, ensuring correct permission assignment even if the user is not present in the paginated members list.

How to Test

  1. Log in as a user with elevated permissions (Author or Editor).
  2. Navigate to the Members settings page for an app or engine.
  3. Ensure the members list is long enough that the logged-in user does not appear on the first page
  4. User can see that they can access member setting permission even if user doesn't appear on the first page of members list

… page of pagination
@pallabi2303 pallabi2303 self-assigned this May 22, 2025
@pallabi2303 pallabi2303 requested a review from a team as a code owner May 22, 2025 09:17
Copy link

@CodiumAI-Agent /describe

@CodiumAI-Agent
Copy link

Title

feat(client): User permission set correctly also if user is not present on the 1st page of pagination in app/engine settings


User description

Description

The logged-in user's permission is determined by a dedicated API call, ensuring correct access rights are set even if the user does not appear on the first page of the members list. This guarantees accurate UI controls regardless of pagination.

Changes Made

  1. Added a dedicated API call to fetch the logged-in user's member record directly, using their user ID and a limit of 1.

  2. Implemented the setUserDetails function to set the logged-in user's data and permission based on the result of this
    dedicated API call, ensuring correct permission assignment even if the user is not present in the paginated members list.

How to Test

  1. Log in as a user with elevated permissions (Author or Editor).
  2. Navigate to the Members settings page for an app or engine.
  3. Ensure the members list is long enough that the logged-in user does not appear on the first page
  4. User can see that they can access member setting permission even if user doesn't appear on the first page of members list

PR Type

Bug fix, Enhancement


Description

  • Add dedicated API call for current user details

  • Refactor setUserDetails to use new userDetails data

  • Update effect to trigger on userDetails.status success

  • Simplify disabled logic removing adminMode checks


Changes walkthrough 📝

Relevant files
Enhancement
MembersTable.tsx
Dedicated user fetch and permission logic refactor             

packages/client/src/components/settings/MembersTable.tsx

  • Introduced getUserDataApi and userDetails hook
  • Refactored setUserDetails to use userDetails.data.members[0]
  • Updated useEffect to depend on userDetails instead of getMembers
  • Simplified disabled conditions by removing adminMode checks
  • +99/-66 

    Need help?
  • Type /help how to ... in the comments thread for any questions about PR-Agent usage.
  • Check out the documentation for more information.
  • Copy link

    @CodiumAI-Agent /review

    Copy link

    @CodiumAI-Agent /improve

    @CodiumAI-Agent
    Copy link

    PR Reviewer Guide 🔍

    Here are some key observations to aid the review process:

    ⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪
    🧪 No relevant tests
    🔒 No security concerns identified
    ⚡ Recommended focus areas for review

    Missing Data Check

    Accessing userDetails.data.members[0] without verifying that members array is non-empty could cause runtime errors if the API returns no members

    setUserData(userDetails.data.members[0]);
    if (adminMode) {
    Null-Safety Inconsistency

    Permission priority is accessed without optional chaining in some places, which can cause undefined property errors if permissionPriorityMapper returns undefined

    permissionPriorityMapper(
        userPermission,
    )
        .priority >
        1

    @CodiumAI-Agent
    Copy link

    CodiumAI-Agent commented May 22, 2025

    PR Code Suggestions ✨

    Latest suggestions up to d90be3d

    CategorySuggestion                                                                                                                                    Impact
    Possible issue
    Use username for filtering

    The engine‐user fetch should filter by the current user's name, not their numeric or
    UUID ID, to match the original behavior of filtering by member.name. Replace
    configStore.store.user.id with configStore.store.user.name for the search parameter.

    packages/client/src/components/settings/MembersTable.tsx [293-301]

     getUserDataApi = [
         'getEngineUsers',
         adminMode,
         id,
    -    configStore.store.user.id,
    +    configStore.store.user.name, // use username to filter
         permissionPriorityMapper(permissionFilter)?.permission,
         0, // offset
         1, // limit
     ];
    Suggestion importance[1-10]: 9

    __

    Why: Replacing configStore.store.user.id with configStore.store.user.name fixes the filter to match by username as intended and prevents incorrect user lookup.

    High
    Restore engine pagination

    The members API for engine types lost pagination and search functionality. Restore
    use of debouncedSearch and rowsPerPage to correctly page through engine users.

    packages/client/src/components/settings/MembersTable.tsx [303-310]

     getMembersApi = [
         'getEngineUsers',
         adminMode,
         id,
    -    configStore.store.user.id,
    +    debouncedSearch || undefined,
         permissionPriorityMapper(permissionFilter)?.permission,
    -    0, // offset
    -    1, // limit
    +    (page + 1) * rowsPerPage - rowsPerPage, // offset
    +    rowsPerPage, // limit
     ];
    Suggestion importance[1-10]: 8

    __

    Why: The current engine users call always returns only the first record (limit = 1) and ignores debouncedSearch, breaking pagination and search; restoring those parameters fixes functionality.

    Medium
    Add guard for empty members

    Guard against empty member arrays to avoid runtime crashes when members[0] is
    undefined. Check that userDetails.data.members has at least one entry before
    indexing.

    packages/client/src/components/settings/MembersTable.tsx [327-344]

     const setUserDetails = () => {
    -    setUserData(userDetails.data.members[0]);
    +    const members = userDetails.data.members;
    +    if (!members || members.length === 0) return;
    +    setUserData(members[0]);
         if (adminMode) {
             const adminPermissionPriority = 'Author';
             setUserPermission(
                 permissionPriorityMapper(adminPermissionPriority)
                     ?.permission as SETTINGS_ROLE,
             );
         } else {
             setUserPermission(
                 permissionPriorityMapper(
    -                userDetails.data.members[0].permission === 'OWNER'
    -                    ? 'Author'
    -                    : userDetails.data.members[0].permission,
    +                members[0].permission === 'OWNER' ? 'Author' : members[0].permission,
                 )?.permission as SETTINGS_ROLE,
             );
         }
     };
    Suggestion importance[1-10]: 7

    __

    Why: Adding a check for userDetails.data.members length prevents runtime errors when the members array is empty and ensures safe indexing of members[0].

    Medium

    Previous suggestions

    Suggestions up to commit ba4f454
    CategorySuggestion                                                                                                                                    Impact
    Possible issue
    Prevent indexing empty members

    Guard against empty or missing members before accessing index 0 to prevent runtime
    errors. Return early or provide a fallback if no member is found.

    packages/client/src/components/settings/MembersTable.tsx [334]

    +if (!userDetails.data.members || userDetails.data.members.length === 0) {
    +    return;
    +}
     setUserData(userDetails.data.members[0]);
    Suggestion importance[1-10]: 7

    __

    Why: Guarding against empty userDetails.data.members prevents a runtime error when accessing index 0 if the array is empty.

    Medium
    Add default permission fallback

    Provide a safe default when permissionPriorityMapper returns undefined to avoid
    casting undefined as a role. Extract the raw permission first, then coalesce to a
    fallback like 'Read-Only'.

    packages/client/src/components/settings/MembersTable.tsx [342-348]

    -setUserPermission(
    -    permissionPriorityMapper(
    -        userDetails.data.members[0].permission === 'OWNER'
    -            ? 'Author'
    -            : userDetails.data.members[0].permission,
    -    )?.permission as SETTINGS_ROLE,
    -);
    +const rawPermission = userDetails.data.members[0].permission === 'OWNER'
    +    ? 'Author'
    +    : userDetails.data.members[0].permission;
    +const mapped = permissionPriorityMapper(rawPermission)?.permission ?? 'Read-Only';
    +setUserPermission(mapped as SETTINGS_ROLE);
    Suggestion importance[1-10]: 6

    __

    Why: Providing a fallback prevents casting undefined from permissionPriorityMapper to SETTINGS_ROLE, avoiding potential type or runtime issues.

    Low
    General
    Default API permission value

    Ensure the permission argument passed to the API is never undefined by falling back
    to a safe default. This prevents sending null or undefined to the backend.

    packages/client/src/components/settings/MembersTable.tsx [309]

    -permissionPriorityMapper(permissionFilter)?.permission,
    +permissionPriorityMapper(permissionFilter)?.permission ?? 'Read-Only',
    Suggestion importance[1-10]: 5

    __

    Why: Falling back when permissionPriorityMapper(permissionFilter)?.permission is undefined avoids sending an invalid permission to the backend, though the impact is minor.

    Low

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature.
    // return;
    // }
    setUserDetails();
    }, [userDetails.status, userDetails.data]);
    Copy link
    Contributor

    Choose a reason for hiding this comment

    The reason will be displayed to describe this comment to others. Learn more.

    Let's try to remove the dependencies and check it once. We don't need to call setUserDetails again and again on pagination as it wouldn't change

    Copy link
    Contributor Author

    Choose a reason for hiding this comment

    The reason will be displayed to describe this comment to others. Learn more.

    Yes , I have removed userDetails.data dependency as it wouldn't affect the behavior, so that setUserDetails wouldn't be called again and again.

    anurag91jain and others added 2 commits May 24, 2025 00:22

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature.

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature.
    @@ -295,65 +295,69 @@ export const MembersTable = (props: MembersTableProps) => {
    setPage(0);
    }, [debouncedSearch]);

    const getUserDataApi: Parameters<typeof useAPI>[0] =
    Copy link
    Contributor

    Choose a reason for hiding this comment

    The reason will be displayed to describe this comment to others. Learn more.

    This double ternary seems worse than just a if else, and it is harder to read.

    Copy link
    Contributor Author

    Choose a reason for hiding this comment

    The reason will be displayed to describe this comment to others. Learn more.

    Now I've changed the double ternary to simple if-else statements.

    pallabi2303 and others added 2 commits May 26, 2025 15:40

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature.

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature.
    ]
    : type === 'APP'
    ? [
    'getProjectUsers',
    adminMode,
    id,
    debouncedSearch ? debouncedSearch : undefined,
    Copy link
    Contributor

    Choose a reason for hiding this comment

    The reason will be displayed to describe this comment to others. Learn more.

    why did we get rid of this?

    Copy link
    Contributor

    Choose a reason for hiding this comment

    The reason will be displayed to describe this comment to others. Learn more.

    Fixed it @AAfghahi and consolidated 2 if conditions into 1.

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature.
    @johbaxter
    Copy link
    Contributor

    johbaxter commented May 30, 2025

    May be a separate issue.

    Im logged in as cc:
    image

    Should i be able to demote authors, or should i only be able to demote users of the same status as me along with myself:
    image

    I can push this, but yeah still think there's issues.

    Lmk what you think @AAfghahi

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature.

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature.
    @pallabi2303
    Copy link
    Contributor Author

    Yes, the issue has been resolved. Editors no longer have the ability to demote Authors.

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature.
    @johbaxter
    Copy link
    Contributor

    Looks good ty

    @johbaxter johbaxter merged commit 83a373a into dev Jun 5, 2025
    3 checks passed
    @johbaxter johbaxter deleted the MembersTable-setUserDetailsChange-paginationBug branch June 5, 2025 18:20
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Labels
    None yet
    Projects
    None yet
    5 participants