Show UI management areas to endpoint administrators#203
Merged
Conversation
The admin dashboard and access-request review page were gated on a
client-side check that recognized only ndp_admin or role names ending in
_admin. The role an endpoint administrator actually holds is the
canonical group:{uuid}:admin, which ends in :admin, so endpoint admins
were locked out of their own endpoint's management screens even though
the API treats them as administrators.
The backend already reports effective_role, resolving every admin role
form including the endpoint-scoped one. The UI now trusts that value
instead of re-deriving admin status from role strings. The helper moved
to services/roles.js so it can be unit tested without importing the
axios client, and the string fallback (for an older backend) now also
recognizes the :admin form.
Closes #202
rbardaji
force-pushed
the
fix/202-ui-endpoint-admin-role
branch
from
July 25, 2026 07:13
8670da3 to
4eefdca
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #202
Problem
The admin dashboard and the access-request review page were shown only to holders of the platform-wide
ndp_adminrole. A user who administers this endpoint — but is not a platform admin — did not see them, even though the API treats them as an administrator.The endpoint-scoped admin role the identity provider issues is
group:{endpoint-uuid}:admin. The UI decided admin status with a client-side check that matched onlyndp_adminor names ending in_admin; the canonical form ends in:adminand was missed. So the person who administers an endpoint was locked out of that endpoint's own management screens.Reported from the field alongside the test-token issue.
Fix
The backend already reports
effective_roleon/user/info, resolving every admin role form including the endpoint-scoped one. The UI now trusts that value instead of re-deriving admin status from role strings.The helper moved to
ui/src/services/roles.jsso it can be unit-tested without importing the axios client (whose ESM build the CRA jest transform rejects). The role-string fallback, for a backend old enough not to sendeffective_role, now also recognizes the:adminform.Verified
ui/src/services/roles.test.js: 7 cases covering the canonical, legacy and platform admin roles, theeffective_rolepath, and malformed input.App.test.jsfails identically onmain(pre-existing module-resolution issue, untouched here).Compiled successfully).UI only — no API, route or payload changes.
Note on versioning
Bumps to 0.33.2, assuming #201 (0.33.1) merges first. If merge order differs, the version line and CHANGELOG will need a trivial rebase.