Aman-Mittal commented on issue #138:
URL:
https://github.com/apache/fineract-backoffice-ui/issues/138#issuecomment-5306579983
Partly implemented in #368 — two of the three acceptance criteria, and I
want to be explicit about
the third rather than quietly leave the box unticked.
- [x] **Hovering a nav item shows what you can do there.** "Clients" reads
*"View and create
clients"* for a user holding `READ_CLIENT` and `CREATE_CLIENT`.
- [x] **Dynamically computed from the user's current permissions.** Derived
from the codes the
user actually holds for that entity, not from the single code the entry is
gated on — otherwise
it would only ever repeat the gate back. A superuser gets no hint at all:
`ALL_FUNCTIONS` has no
individual codes to enumerate, and "you can do everything" on all 115
entries is noise.
- [ ] **Hovering a *restricted* item shows "Contact admin to request:
CREATE_LOAN".**
The third one contradicts #142 and the navigation gating in #368, which
removes entries the user
cannot reach. Both cannot be true at once, so this is a design decision
rather than something to
implement alongside. The reasoning for keeping the removal:
A menu is a list of destinations. An entry the user cannot open is not a
destination, and a
permission-less user would meet the entire sidebar greyed out — every
module, every sub-item —
which is worse than a short menu and buries whatever they *can* do. It also
reverses gating that
#142 asked for and #368 shipped.
Where naming the missing permission genuinely helps, #368 does it, in the
two places the user has
already committed to the thing they are being refused:
- **Actions on a record they are looking at** are disabled with 🔒 and
*"Requires: APPROVE_LOAN —
Approve loans"* rather than hidden (#139). Absence there reads as a
missing feature; on a menu it
reads as a shorter menu.
- **The Access Denied page** names the permissions the route wanted, both as
codes and as a
sentence, when someone reaches a URL they cannot open.
So the intent behind this criterion — the user learns what to ask an
administrator for — is served;
the sidebar is just not where it is served. If you would rather have
greyed-out nav entries, that
is a reasonable product call and I am happy to do it, but it should reopen
#142 explicitly rather
than land as a side effect.
Playwright coverage is in `e2e/rbac-route-protection.spec.ts` ("permission
feedback"): the hint on
a visible entry, and its absence for a superuser.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
