Disable selecting non-immediate child organizations in selective user share tree#10474
Open
SujanSanjula96 wants to merge 1 commit into
Open
Conversation
Contributor
📝 WalkthroughWalkthroughAdds a ChangesSelective org share restriction
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
SujanSanjula96
force-pushed
the
fix/restrict-selective-share-to-direct-sub-orgs
branch
from
June 26, 2026 08:33
3999ebd to
e964c3f
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.changeset/restrict-selective-share-direct-sub-orgs.md:
- Around line 2-3: The changeset includes an unrelated bump for `@wso2is/i18n`
even though the diff only changes common.ui.shared-access.v1 and reuses existing
translation keys. Update the changeset entry to keep only the package that
actually changed, and use the correct bump type for that package so the release
metadata matches the real code changes.
In
`@features/common.ui.shared-access.v1/components/selective-org-share-with-selective-roles.tsx`:
- Around line 945-953: The org tree is using isOrgSelectionDisabled to disable
items, which also prevents expanding or focusing parent nodes and blocks access
to descendants. Update the selective-org-share-with-selective-roles tree logic
so restricted orgs remain interactive but cannot be selected: remove the use of
item-disabling behavior and enforce the restriction in the item interaction
handlers instead. Keep expansion/collapse working for nodes rendered by the tree
view while only ignoring selection for restricted orgs, preserving the
descendant read-only flow in the related hierarchy logic.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: d970ba28-090c-40ec-8887-a0b6c400d210
📒 Files selected for processing (2)
.changeset/restrict-selective-share-direct-sub-orgs.mdfeatures/common.ui.shared-access.v1/components/selective-org-share-with-selective-roles.tsx
Comment on lines
+2
to
+3
| "@wso2is/common.ui.shared-access.v1": patch | ||
| "@wso2is/i18n": patch |
Contributor
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
@wso2is/i18n looks unrelated to this PR’s actual file changes.
I only see a common.ui.shared-access.v1 source change in this cohort, and the TSX diff reuses existing translation keys. Keeping Line 3 will publish @wso2is/i18n without evidence of a package change here. As per coding guidelines, changesets should include the packages that actually changed with the appropriate bump type.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.changeset/restrict-selective-share-direct-sub-orgs.md around lines 2 - 3,
The changeset includes an unrelated bump for `@wso2is/i18n` even though the diff
only changes common.ui.shared-access.v1 and reuses existing translation keys.
Update the changeset entry to keep only the package that actually changed, and
use the correct bump type for that package so the release metadata matches the
real code changes.
Source: Coding guidelines
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #10474 +/- ##
========================================
Coverage 72.72% 72.73%
========================================
Files 469 469
Lines 70888 70908 +20
Branches 484 240 -244
========================================
+ Hits 51555 51572 +17
- Misses 19037 19225 +188
+ Partials 296 111 -185 🚀 New features to boost your workflow:
|
SujanSanjula96
force-pushed
the
fix/restrict-selective-share-to-direct-sub-orgs
branch
2 times, most recently
from
June 26, 2026 09:13
80dcfa5 to
cac34d2
Compare
SujanSanjula96
force-pushed
the
fix/restrict-selective-share-to-direct-sub-orgs
branch
from
June 30, 2026 06:15
cac34d2 to
2de8ffc
Compare
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (1)
features/common.ui.shared-access.v1/components/selective-org-share-with-selective-roles.tsx (1)
1249-1258: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winRead-only descendant pane is still unreachable.
Restricted descendants never make it into
selectedItems, so the earlier!selectedItems.includes(selectedOrgId)return still wins before this new branch runs. Clicking a non-immediate org therefore shows the generic “select from left panel” state instead of the intended read-only roles view.Suggested fix
- if (!hideLeftPanel && !disableOrgSelection && !selectedItems.includes(selectedOrgId)) { - return ( - <Box className="role-list-container center"> - { t("applications:edit.sections.sharedAccess.toManageOrganizationSelectLeftPanel") } - </Box> - ); - } - // When sharing is restricted to immediate child organizations (user and agent sharing), // non-immediate sub-organizations (whose parent is not the root organization) do not have their // own sharing policy. Their role assignments are inherited and cannot be modified. Show a // read-only view of the currently assigned roles instead. const selectedOrgParentId: string | undefined = flatOrganizationMap[selectedOrgId]?.parentId; const isNonImmediateOrgInUserSharing: boolean = restrictToImmediateChildOrgs && !isEmpty(selectedOrgId) && !isEmpty(selectedOrgParentId) && selectedOrgParentId !== organizationId; + + if ( + !hideLeftPanel && + !disableOrgSelection && + !selectedItems.includes(selectedOrgId) && + !isNonImmediateOrgInUserSharing + ) { + return ( + <Box className="role-list-container center"> + { t("applications:edit.sections.sharedAccess.toManageOrganizationSelectLeftPanel") } + </Box> + ); + }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@features/common.ui.shared-access.v1/components/selective-org-share-with-selective-roles.tsx` around lines 1249 - 1258, The read-only descendant view in selective-org-share-with-selective-roles.tsx is still unreachable because the earlier selectedItems guard returns before the new non-immediate-org branch can run. Update the selection flow around the logic that uses selectedItems, selectedOrgId, and isNonImmediateOrgInUserSharing so that restricted descendants bypass the “select from left panel” early return and reach the read-only roles pane. Keep the existing immediate-child/org-sharing checks intact, but reorder or refine the conditions so non-immediate descendants are handled explicitly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In
`@features/common.ui.shared-access.v1/components/selective-org-share-with-selective-roles.tsx`:
- Around line 1249-1258: The read-only descendant view in
selective-org-share-with-selective-roles.tsx is still unreachable because the
earlier selectedItems guard returns before the new non-immediate-org branch can
run. Update the selection flow around the logic that uses selectedItems,
selectedOrgId, and isNonImmediateOrgInUserSharing so that restricted descendants
bypass the “select from left panel” early return and reach the read-only roles
pane. Keep the existing immediate-child/org-sharing checks intact, but reorder
or refine the conditions so non-immediate descendants are handled explicitly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: 2cbd92d8-8efe-46ce-ba6f-033c1b41a017
📒 Files selected for processing (3)
features/admin.agents.v1/components/edit/share-agent-form.tsxfeatures/admin.users.v1/components/share-user-form.tsxfeatures/common.ui.shared-access.v1/components/selective-org-share-with-selective-roles.tsx
pavinduLakshan
approved these changes
Jul 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Related Issues
Related PRs
Checklist
Security checks
Developer Checklist (Mandatory)
product-isissue to track any behavioral change or migration impact.