Skip to content

Added necessary permissions for the run/deploy buttons - #29527

Merged
Rohit0301 merged 12 commits into
mainfrom
fix-29468
Jun 30, 2026
Merged

Added necessary permissions for the run/deploy buttons#29527
Rohit0301 merged 12 commits into
mainfrom
fix-29468

Conversation

@Rohit0301

@Rohit0301 Rohit0301 commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

Describe your changes:

Screenshot 2026-06-26 at 4 53 11 PM

Fixes 29468

I worked on ... because ...

Type of change:

  • Bug fix
  • Improvement
  • New feature
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation

High-level design:

N/A — small change.

Tests:

Use cases covered

Unit tests

Backend integration tests

Ingestion integration tests

Playwright (UI) tests

Manual testing performed

UI screen recording / screenshots:

Not applicable.

Checklist:

  • I have read the CONTRIBUTING document.
  • My PR title is Fixes <issue-number>: <short explanation>
  • My PR is linked to a GitHub issue via Fixes #<issue-number> above.
  • I have commented on my code, particularly in hard-to-understand areas.
  • For JSON Schema changes: I updated the migration scripts or explained why it is not needed.
  • For UI changes: I attached a screen recording and/or screenshots above.
  • I have added tests (unit / integration / Playwright as applicable) and listed them above.

Greptile Summary

This PR fixes a permission gap where the "Run" button on ingestion pipelines was gated on Operation.EditAll instead of the more granular Operation.Trigger. Users with only Trigger permission couldn't run pipelines, and users with EditAll but no Trigger permission could run them incorrectly.

  • PipelineActionsDropdown.tsx: Extracts a triggerPermission from Operation.Trigger (defaulting to false) and uses it to gate the run button, keeping deploy/re-deploy/edit/kill gated on editPermission (EditAll).
  • Permissions.mock.ts + PipelineActionsDropdown.test.tsx: Adds Trigger: true to the shared mock so existing tests remain green, and adds a new unit test verifying the run button disappears when Trigger is false while EditAll is true.
  • ServiceCreationPermissions.spec.ts: Adds two E2E scenarios — a Trigger-only user who can run but not edit, and an EditAll-only user who can edit/redeploy but not run.

Confidence Score: 5/5

Safe to merge — the change is a small, targeted permission-gate fix on a single button with matching unit and E2E test coverage.

The component change is minimal and correct: triggerPermission is derived from the right operation, defaults to false (fail-closed), and the useMemo dependency array is updated consistently. Existing tests are preserved through the Trigger: true addition to the shared mock.

The Playwright spec's beforeAll setup silently discards the deploy response; worth asserting its status to make future flakiness easier to diagnose.

Important Files Changed

Filename Overview
openmetadata-ui/src/main/resources/ui/src/components/Settings/Services/Ingestion/IngestionListTable/PipelineActions/PipelineActionsDropdown.tsx Extracts triggerPermission from Operation.Trigger and gates the run button on it instead of editPermission; deploy/re-deploy remain gated on editPermission (EditAll).
openmetadata-ui/src/main/resources/ui/src/components/Settings/Services/Ingestion/IngestionListTable/PipelineActions/PipelineActionsDropdown.test.tsx Adds a unit test confirming the run button is hidden when Operation.Trigger is false while EditAll remains true; imports ENTITY_PERMISSIONS for structured permission overrides.
openmetadata-ui/src/main/resources/ui/src/mocks/Permissions.mock.ts Adds Trigger: true to ENTITY_PERMISSIONS so existing tests that rely on the full permission set remain passing after the component change.
openmetadata-ui/src/main/resources/ui/playwright/e2e/Flow/ServiceCreationPermissions.spec.ts Adds two E2E tests covering Trigger-only and EditAll-only user scenarios; pipeline deploy call result is unchecked, which could cause the run-button visibility assertion to fail if the deployed flag is not set.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[PipelineActionsDropdown renders] --> B{ingestionPipelinePermissions}
    B --> C[editPermission = Operation.EditAll]
    B --> D[deletePermission = Operation.Delete]
    B --> E[triggerPermission = Operation.Trigger]

    C --> F{ingestion.deployed?}
    E --> F

    F -->|true| G{ingestion.enabled?}
    F -->|false| H[deploy button - hidden: !editPermission]

    G -->|true| I[run button - hidden: !triggerPermission]
    G -->|true| J[re-deploy button - hidden: !editPermission]
    G -->|false| K[deploy/run buttons not shown]

    C --> L[edit button - hidden: !editPermission]
    C --> M[kill button - hidden: !editPermission]
    D --> N[delete button - hidden: !deletePermission]
Loading
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[PipelineActionsDropdown renders] --> B{ingestionPipelinePermissions}
    B --> C[editPermission = Operation.EditAll]
    B --> D[deletePermission = Operation.Delete]
    B --> E[triggerPermission = Operation.Trigger]

    C --> F{ingestion.deployed?}
    E --> F

    F -->|true| G{ingestion.enabled?}
    F -->|false| H[deploy button - hidden: !editPermission]

    G -->|true| I[run button - hidden: !triggerPermission]
    G -->|true| J[re-deploy button - hidden: !editPermission]
    G -->|false| K[deploy/run buttons not shown]

    C --> L[edit button - hidden: !editPermission]
    C --> M[kill button - hidden: !editPermission]
    D --> N[delete button - hidden: !deletePermission]
Loading

Reviews (7): Last reviewed commit: "Merge branch 'main' into fix-29468" | Re-trigger Greptile

@Rohit0301 Rohit0301 self-assigned this Jun 26, 2026
@Rohit0301
Rohit0301 requested a review from a team as a code owner June 26, 2026 10:04
@Rohit0301 Rohit0301 added the safe to test Add this label to run secure Github workflows on PRs label Jun 26, 2026
@github-actions

github-actions Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

✅ PR checks passed

The linked issue has a description and all required Shipping project fields set. Thanks!

Comment thread openmetadata-ui/src/main/resources/ui/playwright.config.ts Outdated
@github-actions

github-actions Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

Jest test Coverage

UI tests summary

Lines Statements Branches Functions
Coverage: 62%
63.05% (70467/111757) 45.9% (40651/88560) 47.34% (12577/26567)

@github-actions

github-actions Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

🟡 Playwright Results — all passed (40 flaky)

✅ 4438 passed · ❌ 0 failed · 🟡 40 flaky · ⏭️ 38 skipped

Shard Passed Failed Flaky Skipped
🟡 Shard 1 321 0 4 4
🟡 Shard 2 818 0 11 9
🟡 Shard 3 830 0 4 7
🟡 Shard 4 827 0 1 10
🟡 Shard 5 860 0 14 0
🟡 Shard 6 782 0 6 8
🟡 40 flaky test(s) (passed on retry)
  • Flow/Tour.spec.ts › Tour should work from help section (shard 1, 2 retries)
  • Pages/SearchSettings.spec.ts › Preview config reflects reverted n-gram weight after save (shard 1, 1 retry)
  • Flow/SearchRBAC.spec.ts › the browse tree only shows the asset-type categories a user can access (shard 1, 1 retry)
  • Features/DomainIsolation/DomainSearchIsolation.spec.ts › userA finds tenantA and domainless tables but not tenantB (shard 1, 1 retry)
  • Features/BulkEditEntity.spec.ts › Glossary (shard 2, 1 retry)
  • Features/BulkImport.spec.ts › Database service (shard 2, 1 retry)
  • Features/BulkImport.spec.ts › Database (shard 2, 1 retry)
  • Features/BulkImport.spec.ts › Keyboard Delete selection (shard 2, 1 retry)
  • Features/BulkImportWithDotInName.spec.ts › Import at schema level with dot in service name (shard 2, 1 retry)
  • Features/Container.spec.ts › expand / collapse should not appear after updating nested fields for container (shard 2, 1 retry)
  • Features/ContextCenterPermission.spec.ts › user with createAll permission cannot see restore or delete actions on an archived document (shard 2, 1 retry)
  • Features/ContextCenterPermission.spec.ts › user with deleteAll permission can see delete action but not restore action on an archived document, and can delete it (shard 2, 1 retry)
  • Features/DataQuality/TestCaseImportExportE2eFlow.spec.ts › Admin: Complete export-import-validate flow (shard 2, 2 retries)
  • Features/ExploreQuickFilters.spec.ts › explore tree sidebar selection is not cleared when a top dropdown filter is applied (shard 2, 1 retry)
  • Features/GlobalSearchSuggestions.spec.ts › Navigate to column from column suggestion (shard 2, 1 retry)
  • Features/KnowledgeCenterTextEditor.spec.ts › Rich Text Editor - Text Formatting (shard 3, 1 retry)
  • Features/Permissions/EntityPermissions.spec.ts › Metric deny common operations permissions (shard 3, 1 retry)
  • Features/Permissions/EntityPermissions.spec.ts › File allow common operations permissions (shard 3, 1 retry)
  • Flow/ApiCollection.spec.ts › Verify Owner Propagation: owner should be propagated to the API Collection's API Endpoint (shard 3, 1 retry)
  • Pages/CustomProperties.spec.ts › Time Interval (shard 4, 1 retry)
  • Pages/Entity.spec.ts › Certification Add Remove (shard 5, 1 retry)
  • Pages/Entity.spec.ts › Follow & Un-follow entity (shard 5, 1 retry)
  • Pages/Entity.spec.ts › Domain Propagation (shard 5, 1 retry)
  • Pages/Entity.spec.ts › Tag and Glossary Selector should close vice versa (shard 5, 1 retry)
  • Pages/Entity.spec.ts › Tag Add, Update and Remove (shard 5, 1 retry)
  • Pages/Entity.spec.ts › Update displayName (shard 5, 1 retry)
  • Pages/Entity.spec.ts › UpVote & DownVote entity (shard 5, 1 retry)
  • Pages/Entity.spec.ts › Domain Propagation (shard 5, 1 retry)
  • Pages/EntityDataConsumer.spec.ts › DisplayName edit for child entities should not be allowed (shard 5, 1 retry)
  • Pages/EntityDataSteward.spec.ts › Glossary Term Add, Update and Remove for child entities (shard 5, 1 retry)
  • ... and 10 more

📦 Download artifacts

How to debug locally
# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip    # view trace

@Rohit0301 Rohit0301 added the To release Will cherry-pick this PR into the release branch label Jun 26, 2026
@sonarqubecloud

Copy link
Copy Markdown

@Rohit0301
Rohit0301 enabled auto-merge (squash) June 30, 2026 10:23
@Rohit0301
Rohit0301 merged commit 2401e4b into main Jun 30, 2026
60 of 61 checks passed
@Rohit0301
Rohit0301 deleted the fix-29468 branch June 30, 2026 11:54
@github-actions

Copy link
Copy Markdown
Contributor

Failed to cherry-pick changes to the 1.12.13 branch.
Please cherry-pick the changes manually.
You can find more details here.

@github-actions

Copy link
Copy Markdown
Contributor

Failed to cherry-pick changes to the 1.13 branch.
Please cherry-pick the changes manually.
You can find more details here.

@gitar-bot

gitar-bot Bot commented Jun 30, 2026

Copy link
Copy Markdown
Code Review ✅ Approved 3 resolved / 3 findings

Updates pipeline run permissions to use the trigger operation. All previously identified test and permission gaps have been resolved.

✅ 3 resolved
Bug: Global Playwright baseURL changed from 8585 to 3002

📄 openmetadata-ui/src/main/resources/ui/playwright.config.ts:23-32
playwright.config.ts changes the default base URL for the entire Playwright suite from localhost:8585 to localhost:3002 (both HTTP/1.1 and h2 modes). This is unrelated to the PR's stated purpose (run/deploy button permissions) and affects every E2E test, not just the new ServiceCreationPermissions spec. If CI serves the app on 8585 (the OpenMetadata server port that also serves the bundled UI), this change will break the whole suite unless PLAYWRIGHT_TEST_BASE_URL happens to be set. It looks like a leftover local-dev change that was accidentally committed. Please confirm this is intentional and required for the suite to pass; otherwise revert it to 8585. If 3002 is genuinely correct, also update the now-stale h2 comment on lines 23-26 which still references https://localhost:8585.

Bug: useMemo missing appPermissions dependency causes stale permissions

📄 openmetadata-ui/src/main/resources/ui/src/components/Settings/Services/Ingestion/IngestionListTable/PipelineActions/PipelineActionsDropdown.tsx:75-82
In PipelineActionsDropdown.tsx, the permission useMemo now reads appPermissions?.[Operation.Trigger] and appPermissions?.[Operation.Deploy] (lines 79-80), but its dependency array (line 82) still only lists [ingestionPipelinePermissions]. appPermissions comes from permissions[ResourceEntity.APPLICATION], which is populated asynchronously from GET /permissions by the PermissionProvider. If appPermissions is initially empty/undefined on first render and resolves later (or changes), the memo will not recompute, so triggerPermission/deployPermission will remain false and the Run / Re-deploy / Deploy buttons stay hidden even though the user has the permission. Add appPermissions to the dependency array.

Bug: Unit tests assert old Deploy-permission semantics; will fail in CI

📄 openmetadata-ui/src/main/resources/ui/src/components/Settings/Services/Ingestion/IngestionListTable/PipelineActions/PipelineActionsDropdown.test.tsx:138-152 📄 openmetadata-ui/src/main/resources/ui/src/components/Settings/Services/Ingestion/IngestionListTable/PipelineActions/PipelineActionsDropdown.test.tsx:167-181
The recent commit changed PipelineActionsDropdown so the re-deploy/deploy buttons are gated on editPermission (ingestionPipelinePermissions[EditAll]) and the run button on triggerPermission (ingestionPipelinePermissions[Trigger]). The appPermissions/Deploy-based gating was removed. However PipelineActionsDropdown.test.tsx was not updated and still encodes the removed Deploy semantics, so two tests now fail:

  1. should hide deploy and re-deploy buttons when Deploy permission is absent (lines 138-165): renders with ENTITY_PERMISSIONS + Deploy: false, but EditAll remains true. Since re-deploy now depends on editPermission, the button is rendered, so expect(screen.queryByTestId('re-deploy-button')).toBeNull() fails.

  2. should show run and re-deploy buttons for Trigger/Deploy without EditAll (lines 167-198): renders with EditAll: false, Trigger: true, Deploy: true. Since re-deploy now depends on editPermission (false), the button is hidden, so expect(screen.getByTestId('re-deploy-button')).toBeInTheDocument() fails.

Update these tests to reflect that re-deploy/deploy visibility is driven by EditAll and run visibility by Trigger. For test 1, set EditAll: false (and rename/retarget to EditAll) to hide re-deploy. For test 2, drop the re-deploy assertion or set EditAll: true, since a Trigger-only user no longer sees re-deploy.

Options

Display: compact → Showing less information.

Comment with these commands to change:

Compact
gitar display:verbose         

Was this helpful? React with 👍 / 👎 | Gitar

Rohit0301 added a commit that referenced this pull request Jun 30, 2026
* Added necessary permissions for the run/deploy buttons

* fixed the playwright test

* addressed gitar comment

* added ingestion trigger permissino instead of all

* fix playwright

* minor fix

* lint fix

* unit test fix
Rohit0301 added a commit that referenced this pull request Jun 30, 2026
* Added necessary permissions for the run/deploy buttons

* fixed the playwright test

* addressed gitar comment

* added ingestion trigger permissino instead of all

* fix playwright

* minor fix

* lint fix

* unit test fix
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

safe to test Add this label to run secure Github workflows on PRs To release Will cherry-pick this PR into the release branch

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Gate ingestion pipeline Run action on Operation.Trigger instead of EditAll (UI/backend permission mismatch since 1.12.9)

2 participants