feat(intelligent-assistant): gate UI by consolidated RBAC permissions - #4651
feat(intelligent-assistant): gate UI by consolidated RBAC permissions#4651rohitratannagar wants to merge 13 commits into
Conversation
Replace legacy Lightspeed permission hooks with four feature-level RBAC permissions and hide UI elements when access is denied instead of showing permission-denied screens or read-only MCP mode. Signed-off-by: rohitratannagar <rohitratannagar2003@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
|
Important This PR includes changes that affect public-facing API. Please ensure you are adding/updating documentation for new features or behavior. Changed Packages
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #4651 +/- ##
==========================================
- Coverage 62.72% 62.41% -0.31%
==========================================
Files 2636 2623 -13
Lines 105422 105270 -152
Branches 29521 29577 +56
==========================================
- Hits 66125 65709 -416
- Misses 38762 38992 +230
- Partials 535 569 +34
*This pull request uses carry forward flags. Click here to find out more. Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
Both chats and notebooks permissionsScreen.Recording.2026-09-09.at.7.14.21.PM.movOnly chat permissionScreen.Recording.2026-09-09.at.7.14.52.PM.movOnly notebook permissionScreen.Recording.2026-09-09.at.7.15.22.PM.movno permission (FAB disappear)Screen.Recording.2026-09-09.at.7.15.52.PM.movMCP setting pageScreen.Recording.2026-09-09.at.7.17.00.PM.mov |
|
/fs-review |
|
🤖 Finished Review · ❌ Failure (validation failed after 2 iteration(s)) · Started 3:03 AM UTC · Completed 3:06 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-5 |
|
@rohitratannagar Could you please see in Agenticview why fs-review is failing. |
Add component, hook, and Playwright coverage for the consolidated IA permission matrix introduced in redhat-developer#4651, including permission API mocks and page-object based e2e scenarios with post-test MCP permission restore. Signed-off-by: HusneShabbir <husneshabbir447@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
HusneShabbir
left a comment
HusneShabbir
left a comment
There was a problem hiding this comment.
A few observations I noticed:
No Chat/Notebooks access: When a user without Chat or Notebooks access navigates to /intelligent-assistant, they are presented with an empty screen, which leaves them unclear about what to do next.
Screen.Recording.2026-09-10.at.11.49.32.AM.mov
Notebooks UI flicker: When a user has only Notebooks access and already has a notebook, refreshing/reloading /notebooks briefly shows the “No notebooks” state before displaying the existing notebook. This results in a noticeable UI flicker.
Screen.Recording.2026-09-10.at.11.48.29.AM.mov
Use untyped jest.Mock for useAllModels and useConversations mocks to match existing component tests and satisfy CI type checking. Signed-off-by: HusneShabbir <husneshabbir447@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Use isolated browser sessions per permission scenario, scope tab assertions to the chatbot region, and run the suite in English only to avoid parallel locale bootstrap races. Signed-off-by: HusneShabbir <husneshabbir447@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Use per-page permission matrix updates without route races, isolate each scenario in its own browser context, and assert single-permission layouts via tab visibility instead of brittle tab counts and API tracking. Co-authored-by: Cursor <cursoragent@cursor.com>
Bootstrap a fresh browser context per test, register permission mocks on the context, and exclude the permissions suite from non-English locale projects to avoid CI login races. Co-authored-by: Cursor <cursoragent@cursor.com>
Browser-level permission mocking is unreliable in the full CI Playwright suite. Keep component and hook tests that cover all six RBAC scenarios and revert the shared e2e bootstrap permission intercept. Co-authored-by: Cursor <cursoragent@cursor.com>
Run permission gating e2e in an isolated Playwright config that enables the permission framework, applies per-scenario authorize mocks before navigation, and keeps the main e2e suite on the default app config. Co-authored-by: Cursor <cursoragent@cursor.com>
…ks access Return Backstage ErrorPage on /intelligent-assistant when neither intelligent-assistant.chat nor intelligent-assistant.notebooks is granted, instead of rendering an empty page. Co-authored-by: Cursor <cursoragent@cursor.com>
…rmission-gating-automation test(intelligent-assistant): add RBAC permission gating automation
|
Permissions in RBAC cc: @its-mitesh-kumar |
|
/fs-review |
|
🤖 Finished Review · ✅ Success · Started 11:34 PM UTC · Completed 11:56 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $11.87 |
ReviewReason: stale-head The review agent reviewed commit Previous runReviewFindingsMedium
Low
Labels: PR adds RBAC permission gating as a new feature to the intelligent-assistant workspace. |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
There was a problem hiding this comment.
Note: The following review comments could not be posted on the diff (GitHub returned 422) and are included here instead:
workspaces/intelligent-assistant/plugins/intelligent-assistant/src/translations/ref.ts(file-level): Line 300 · [medium] stale-reference
The PR deletes PermissionRequiredIcon.tsx (the only consumer of icon.permissionRequired.alt) and correctly removes 6 other orphaned translation keys, but misses this one in ref.ts and all 5 locale files (de.ts, es.ts, fr.ts, it.ts, ja.ts). The key also remains in report-alpha.api.md.
Suggested fix: Remove the icon.permissionRequired.alt entry from ref.ts and all five locale files, then regenerate report-alpha.api.md.
| const { t } = useTranslation(); | ||
| const { isChatbotActive, toggleChatbot, displayMode } = | ||
| useLightspeedDrawerContext(); | ||
| const { allowed: hasChatAccess, loading: chatPermissionLoading } = |
There was a problem hiding this comment.
[low] code-organization
Permission-gating block (useIaChatPermission + useIaNotebooksPermission + permissionsLoading + hasPluginAccess) duplicated verbatim across 3 components: LightspeedFABContent.tsx, LightspeedChatContainer.tsx, and LightspeedPage.tsx.
Suggested fix: Extract the shared logic into a new useIaPluginAccess hook.
fullsend-ai-review
Bot
added
requires-manual-review
Delete the unused permission-required SVG and drop the stale icon.permissionRequired.alt translation key left behind after removing PermissionRequiredIcon. Co-authored-by: Cursor <cursoragent@cursor.com>
Resolve merge conflicts by combining RBAC permission gating with the intelligent-assistant MUI v5 styled-components migration from main. Co-authored-by: Cursor <cursoragent@cursor.com>
|
🤖 Finished Review · ✅ Success · Started 12:06 PM UTC · Completed 12:27 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $12.22 |
Restore boost catalog test files to match upstream/main. The React import edits were unrelated to intelligent-assistant permission gating. Co-authored-by: Cursor <cursoragent@cursor.com>
|
|
/fs-review |
4 participants
Description
This PR consolidates Intelligent Assistant frontend permission checks around four RBAC permissions and treats them as binary feature gates rather than partial/read-only access modes.
Permission model
intelligent-assistant.chatintelligent-assistant.notebooksintelligent-assistant.mcp.toolsintelligent-assistant.skillsUI gating behavior
intelligent-assistant.mcp.tools. Read-only MCP mode and permission-denied screens are removed — no access means the UI is hidden.enabledflags (e.g.useAllModels,useConversations,useWelcomePrompts) so notebooks-only users do not trigger chat backend calls.Hook refactor
Legacy hooks renamed and aligned to the new permission names:
useLightspeedUpdatePermission→useIaChatPermissionuseLightspeedViewPermission→useIaMcpToolsPermissionuseLightspeedNotebooksPermission→useIaNotebooksPermissionuseLightspeedDeletePermission→useIaSkillsPermissionEach hook returns
{ loading, allowed }only.Cleanup
PermissionRequiredStateandPermissionRequiredIconcomponents.Fixed
intelligent-assistant.chatintelligent-assistant.notebooksintelligent-assistant.mcp.toolsTest Plan
intelligent-assistant.mcp.tools— MCP settings menu and server configuration accessible.yarn test --watchAll=falseinworkspaces/intelligent-assistant— all tests pass.Checklist
Made with Cursor