[IAmJSD]

This is a bug fix. The Permission Overview on Admin > Users, roles & API keys under-reported what groups can do. It matched each group's permissions exactly against a hardcoded list of seven verbs (view, create, update, delete, execute, approve, admin). So the Administrators group, which holds admin:*, showed "—" for every row except admin. Groups holding verb variants such as approve-any, retry-any or cancel-own looked as if they held nothing for those verbs, because the variants had no row. This PR builds the rows from the real action vocabulary and shows what admin:* grants, including the verbs the backend carves out of it.

Part of the UI modernization sweep.

What changed

• frontend/src/users/permissionMatrix.ts:
  • Rows come from ALL_ACTIONS in permissions.ts, plus any action a group stores that the vocabulary lacks, so a granted permission is never hidden. -own / -any variants sort under their base verb, and admin comes last.
  • New exported helpers permissionMatrixActions(groups) and permissionMatrixCell(group, action). A cell is direct (the group grants the action; the tooltip lists the resources), admin (granted through admin:*) or none.
  • A group holding admin:* shows every action as a grey tick with "Granted via admin" in its title and sr-only text. The exception is the verbs carved out of the wildcard: their tick carries a *, and the tooltip names the exceptions ("Via admin:*, except execute:purchases, execute:ri-exchange (needs an explicit grant)"). A direct grant always wins over the admin tick. admin on a single resource is not treated as the wildcard.
  • A note under the table explains the grey ticks and lists the carved-out permissions when any group holds admin:*; otherwise it says to hover a tick for its resources.
• frontend/src/permissions.ts: ADMIN_CARVED_OUTS is exported (it was module-private). The value is unchanged.
• frontend/src/styles/settings.css: grey, regular-weight style for via-admin ticks, the small * mark and the note. The rules sit with the existing .permission-matrix rules (second commit moves them there from the end of the file so the admin PRs don't conflict; no style change).
• frontend/src/__tests__/permission-matrix.test.ts (new, 6 tests): rows cover the whole vocabulary in order; an unknown stored action gets a row; variants map to their own rows; admin:* grants everything via admin except the carved-out verbs; admin on one resource is not the wildcard; an explicit grant beats the wildcard.

Why

The overview is there to answer "who can do what", and it answered wrongly for the most privileged group and for every variant verb.

The * is there because admin:* does not cover everything. The backend's adminCarvedOuts (internal/auth/types.go, mirrored in the frontend as ADMIN_CARVED_OUTS) removes four permissions from the wildcard: execute:purchases, approve-any:purchases and retry-any:purchases (separation of duties for spending money, issue #923) and execute:ri-exchange (issue #1644). HasPermission falls through to an explicit grant for those, so an administrator needs membership in the Purchaser or RI Exchanger group (or a custom group granting them) to perform them. A plain tick on Administrators' execute, approve-any and retry-any rows would therefore claim more than the backend allows. The * and its tooltip show that the tick holds for every resource except the carved-out ones.

Screenshots

Before = main at 43dd618; after = this branch. Headless Chromium at 1440x900 against a mocked API with the seeded groups (Administrators admin:*, Purchaser, RI Exchanger and so on) plus two custom groups.

Before	After
Seven rows. Administrators shows "—" everywhere except admin; FinOps team's approve-any and Standard Users' cancel-own don't appear.	Every action has a row. Administrators has grey ticks with * on execute, approve-any and retry-any; the variant grants appear; a note explains the grey ticks.
Close-up: the Administrators column looks like a group that can only "admin".	Close-up: the via-admin ticks next to the direct (green) grants of Purchaser and RI Exchanger.

Verification

Run on this branch's head a8616073 (main 43dd618 + 2 commits), from frontend/:

• npm run typecheck: pass. npm run lint: 0 errors (141 warnings, the same as main). npm run build: pass.
• Jest: 176 suites; 4601 passed, 1 skipped (the new permission-matrix.test.ts adds 6 tests).
• Playwright (e2e-local.sh, the repo's full suite): 276 passed.

Notes for review

• The table grows from 7 to 20 rows with the current vocabulary. Dropping rows that no group holds would be a small follow-up, but showing the full vocabulary makes it obvious which verbs nobody holds.
• The carved-out list in the note and tooltips comes from ADMIN_CARVED_OUTS, so it follows that set if it changes. Its comment already says it must mirror the backend's adminCarvedOuts.
• The matrix is per action, as before; resources are in the tick's tooltip. A tick for a direct grant still means "on at least one resource".

Overlaps

• frontend/src/styles/settings.css is also touched by ui(settings): admin settings sections as cards with visible hints #1606, ui(accounts): account and registration row actions as icon buttons #1608, ui(settings): quiet danger style for Reset to Defaults #1609 and ui(accounts): accounts page polish (federation cards, file picker) #1611. All pairs merge cleanly in any order. No other sweep PR touches permissionMatrix.ts or permissions.ts.

Note for the UI owner

This changes UI code that @cristim owns. IAmJSD reviewed the before/after screenshots and asked for these PRs; any design point you disagree with can be a follow-up.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 27 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-platform
• Branch: main
• File: .coderabbit.yaml
• Commit: 43dd618
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: c50cf1fe-5bef-4c23-b819-8965a5a7e639

Commits

Reviewing files that changed from the base of the PR and between 43dd618 and a861607.

Files selected for processing: 4

• frontend/src/__tests__/permission-matrix.test.ts
• frontend/src/permissions.ts
• frontend/src/styles/settings.css
• frontend/src/users/permissionMatrix.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Merge gate record (burndown orchestrator)

Independent adversarial review (claude-opus-5-5)
#1610 @ a861607: NO CONFIRMED FINDINGS

• Backend parity: checked permissionMatrixCell against permissionsAllow / AuthContext.HasPermission (internal/auth/service_group.go:338, internal/auth/types.go:173). The admin wildcard only counts when resource is "*" (checkAdminPermission, service_group.go:372). Carve-outs come from adminCarvedOuts (types.go:135), which matches ADMIN_CARVED_OUTS (frontend/src/permissions.ts:173). Verb variants are matched exactly by checkPermissionMatch, with no implication from -any to the base verb, and each variant gets its own row. No cell shows a grant the backend denies or hides one it allows.
• Edge cases: admin on a single resource renders no wildcard. A group with admin:* plus an explicit execute:purchases shows a direct tick. Unknown stored actions still get a row. Groups with no permissions keep the existing empty state.
• XSS: every interpolated value goes through escapeHtml (frontend/src/utils.ts:240), including the title and aria-label attributes.
• Tokens: all new CSS variables exist. This frontend has no dark theme.
• Tests: matrix and permissions suites 59/59. Three mutation probes each failed at least one new test, then were reverted: emptying the except list, dropping the resource==='*' check, and dropping the direct-grant branch.

Local verification
Local verification on macOS @ a861607: PASS

• Stack: real local stack (postgres:16 container, CUDly server built from main, this SHA's dist served with /api proxied, Playwright Chromium), dev admin login, fixture-labelled seed data (fake AWS/Azure/GCP accounts), no cloud credentials.
• npm test exit 1: 4599 passed / 2 failed / 1 skipped; the only failures are the 2 savings-history.test.ts tests that fail on main since the DST change (pre-existing, fixed separately). npm run lint exit 0, npm run build exit 0.
• Driven: Admin > Users > Permission Overview over 8 seeded groups: 28 rows including update-any, approve-any, retry-own, sell-any; Administrators column shows 19 "via admin" ticks and 3 * partial ticks (execute, approve-any, retry-any) with the explanatory note; hover on a * tick names the carved-out actions.
• Screenshots at 1440x900 and 390x844 (matrix, hover), kept with the run evidence. No console errors on desktop; the phone context logs 401s on two list endpoints on every PR in this batch (harness, not PR-specific).

Screenshots (1440x900 and 390x844) are kept with the local run evidence; not attached here.
CodeRabbit not run: the exact-SHA local verification and the Opus review above cover this SHA (repo CLAUDE.md review gate).