Description

Problem

In RHACS, We tested the Analyst role behavior and observed that users with analyst role can see the delete option, after testing on test cluster it confirmed that the "Delete" action is not executable, indicating a UI vs functionality mismatch.
The Analyst role remains read-only, and permissions verified under “My Profile” confirm no write access. However, "Delete" actions ideally should not be visible for user with analyst role only.

Could you please confirm if this is expected or should be treated as a bug? If not expected, should we proceed with raising one?

Analysis

Row actions have isDisabled condition in 3 other list pages:

<Td isActionCell>
    <ActionsColumn
        isDisabled={
            !hasWriteAccessForPage || …)
        }
        items={…}
    />
</Td>

That is, vertical ellipsis button is visible but disabled.

Delete row action has isDisabled condition in auth providers list page:

items={[
    {
        title: 'Delete auth provider',
        isDisabled:
            id === currentUser?.authProvider?.id ||
            isImmutable,
    },
]}

That is, vertical ellipsis button is enabled.

Solution

Be consistent to disable row actions if user role does not have write 'Access' permission or during delete request for table row.

User-facing documentation

• CHANGELOG.md update is not needed
• documentation PR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• added e2e tests
• added regression tests
• added compatibility tests
• modified existing tests

How I validated my change

1. npm run tsc in ui/apps/platform folder.
2. npm run lint:fast-dev in ui/apps/platform folder.
3. npm run start in ui/apps/platform folder with staging demo as central.

Manual testing

Temporarily edit hasWriteAccessForPage condition.

1. Visit /main/access-control/auth-providers

   See vertical ellipsis button is visible but disabled.