Fix policy automations role restrictions in UI - #46910
Conversation
- Disable webhook/ticket checkbox for non-admins (maintainers, technicians) in PolicyAutomationsFields - Hide pencil icon and pointer cursor in Automations cell for roles that can't open the automations modal - Fetch config/team data for all roles so webhook automation shows correctly in the table for technicians
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #46910 +/- ##
==========================================
- Coverage 67.02% 67.02% -0.01%
==========================================
Files 2859 2860 +1
Lines 224683 224699 +16
Branches 11577 11584 +7
==========================================
+ Hits 150592 150601 +9
- Misses 60445 60452 +7
Partials 13646 13646
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
WalkthroughThis PR refactors automations UI permission handling across the policies page. Data queries for global config and team details are decoupled from the Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR adjusts Fleet’s Policies UI permission handling so policy automations are displayed accurately for read-only roles and editing controls are restricted consistently across create/edit/manage flows.
Changes:
- Fetches global config and team config for all authenticated roles (instead of gating on policy write permissions) so webhook/ticket automations render correctly for technicians.
- Makes the Policies table “Automations” cell truly read-only when the user can’t open the Manage automations modal (no pencil icon, no pointer cursor, not keyboard-focusable).
- Introduces a “locked” state for automation checkbox rows and uses it to disable webhook/ticket automation toggles for non-admin roles (e.g., Maintainers).
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| frontend/pages/policies/ManagePoliciesPage/ManagePoliciesPage.tsx | Removes write-permission gating from config/team queries so technicians can see accurate webhook/ticket automations in the table. |
| frontend/pages/policies/ManagePoliciesPage/components/PoliciesTable/PoliciesTableConfig.tsx | Refactors AutomationsCell to render a non-interactive <span> when editing is not allowed (removes misleading click affordances). |
| frontend/pages/policies/ManagePoliciesPage/components/PoliciesTable/_styles.scss | Adds styling for read-only automations cells to keep a non-clickable cursor. |
| frontend/pages/policies/components/PolicyAutomationsFields/types.ts | Adds isLocked to distinguish “role-locked” rows from “feature-disabled” rows. |
| frontend/pages/policies/components/PolicyAutomationsFields/PolicyAutomationsFields.tsx | Locks webhook/ticket automation toggles to admins-only (global admin or team admin for real teams), while keeping other automations behavior intact. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Related issue: Resolves #46912
PolicyAutomationsFields— covers the create modal, edit form, and manage automations modal since all three share the component. (Any role below maintainer can't edit automations.)cursor: pointerare now hidden for roles that can't open the automations modal (technician and below).canAddOrDeletePolicies, which excluded them).Testing
Before
With a global/fleet technician user, Automations cell on Policies page showed "2 automations" when there were actually 3 automations configured.
Also, the pencil (edit) icon and cursor pointer are shown even though technicians can't access the Manage automations modal.
Screen.Recording.2026-06-05.at.12.48.07.PM.mov
Maintainers can manage automations but they can't configure webhooks or tickets (product requirement + also forbidden by BE). This silently failed when checking the "Send webhook" checkbox when creating or editing.
Screen.Recording.2026-06-05.at.12.46.42.PM.mov
After
Technicians see all available automations on the Policies page (and this matches the Details page).
Also, the edit icon is no longer shown, and the Automations cell is no longer clickable.
Screen.Recording.2026-06-05.at.12.44.36.PM.mov
Locked "Send webhook" / "Create ticket" for Maintainers.
https://github.com/user-attachments/assets/f0c0b058-db02-4174-bb8e-33165014806f
Summary by CodeRabbit
Release Notes