CaptainAni187 opened a new pull request, #823: URL: https://github.com/apache/fineract-backoffice-ui/pull/823
## What and why A user with only `ALL_FUNCTIONS_READ` got enabled write controls on three admin screens: the Global Configurations toggles and Edit, and Edit on Users and Roles. Fineract refuses all of them, so the user just ends up on a 403 toast or on Access Denied. - Global Configurations: the toggle and Edit now use `appRequiresPermission="UPDATE_CONFIGURATION"`, so they stay visible (the toggle still shows the current state) but disabled, with the same "Requires ..." hint as the loan and savings actions. - Users and Roles: Edit is gated with `*appHasPermission` on `UPDATE_USER` / `UPDATE_ROLE`, the codes their edit routes already require. That matches Delete, Enable and Disable next to it, which are already hidden the same way. Closes #769 ## Verification - Unit tests in `users-list.component.test.ts` and `roles-list.component.test.ts` for Edit with and without the permission. - Mocked e2e in `e2e/all-functions-read-shortcut.spec.ts`: an `ALL_FUNCTIONS_READ` user goes through all three screens, the toggle and Edit are disabled, clicking them sends no write, and Users/Roles have no Edit. Paired with an `ALL_FUNCTIONS` user who still gets all of them. Both fail on main. I didn't extend `rbac-dead-end-controls.spec.ts` since it needs the backend stack, the mocked spec covers the same check.... happy to add a backend case there too if you want. ## Screenshots Global Configurations as `ALL_FUNCTIONS_READ`, before / after:   Users as `ALL_FUNCTIONS_READ`, before / after:   ## AI assistance (optional) - Tool / model: - Harness / workflow: ## Checklist - [x] I did not hand-edit generated files under `src/app/api/`. - [x] New component or service code uses the adapter boundary in `src/app/core/adapters/` instead of direct browser globals or imperative third-party APIs. - [x] User-facing strings use translation keys. - [x] I added or updated tests appropriate to this change, or explained why tests were not needed. - [x] UI workflow changes include suitable e2e coverage, including real-backend testing where relevant. - [x] Commits are signed — see [Commit Signing](CONTRIBUTING.md#commit-signing) in CONTRIBUTING.md. - [ ] I followed the [AI-assisted contributions guidance](CONTRIBUTING.md#ai-assisted-contributions). - [x] If this adds a feature or changes a workflow, I raised it on [[email protected]](https://lists.apache.org/[email protected]) first — or it is a bug fix, refactor or test change, where that does not apply. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
