From 5ef671f047367a230201e7c26a6354230d511bed Mon Sep 17 00:00:00 2001 From: gitlawr Date: Tue, 12 May 2026 13:32:45 +0800 Subject: [PATCH] feat: dashboard route gated on canSeeOrgAdmin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Relax the dashboard route from canSeeAdmin (strict platform admin) to canSeeOrgAdmin so the access seam can widen the audience past the platform admin — by default platform admin, plus whatever an access extension chooses to admit. The dashboard endpoint takes care of scoping the response per caller. Also move Dashboard under the canSeeOrgAdmin bullet in the access.ts predicate notes. --- config/routes.ts | 5 ++++- src/access.ts | 6 +++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/config/routes.ts b/config/routes.ts index 8b675ec6..2e6adb6f 100644 --- a/config/routes.ts +++ b/config/routes.ts @@ -9,7 +9,10 @@ const baseRoutes = [ icon: 'icon-dashboard', selectedIcon: 'icon-dashboard-filled', defaultIcon: 'icon-dashboard', - access: 'canSeeAdmin', + // `canSeeOrgAdmin` widens to anyone the access seam grants + // admin-ish visibility — by default platform admin, plus + // whatever the routes extension chooses to allow. + access: 'canSeeOrgAdmin', component: './dashboard', routes: [] }, diff --git a/src/access.ts b/src/access.ts index 201f338d..1678b5a9 100644 --- a/src/access.ts +++ b/src/access.ts @@ -14,10 +14,10 @@ export default (initialState: { currentUser?: Global.UserInfo }) => { // Predicate roles, top-down by strictness: // * `canSeeAdmin` — strictly platform admin (`users.is_admin`). - // Gates Users, Dashboard. + // Gates Users. // * `canSeeOrgAdmin` — admin-style menus that work cross-org - // (Resources, Models, Cluster Management). Defaults to platform - // admin; extensions widen to include org admins. + // (Dashboard, Resources, Models, Cluster Management). Defaults + // to platform admin; extensions widen to include org admins. // * `canManageCurrentOrg` — pages that only make sense inside a // specific org context (member / group management). Defaults to // `false`; extensions widen when both an org is selected AND