Repository navigation
Hide role assignments from viewers who can't see the org's roles - #36
Merged
Merged
Conversation
Roles are only readable by members, or by anyone if the org is public. Everyone else got an empty role list, so each ARCI chart and the accountable line rendered as red "Unknown role" badges. Hide them under the same rule as the RLS policy. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
After #35 deployed, logged-out visitors to
/org/uwischool/process/TeachingEvaluationssee red "Unknown role" badges in every step's ARCI chart and on the "… is accountable" line.The roles RLS policy only returns roles to members, or to anyone if the org is public. Everyone else gets an empty role list, so
RoleLinkshows its "Unknown role" badge for every assignment.Change
Show role assignments only when
member || org.visibility === 'public', which is the same rule as the RLS policy.ARCI.svelte: render nothing when the viewer can't see roles. This covers both the top step's chart and each sub-step's chart.(The roles, processes and changes list pages use a narrower check that also hides public-org roles from logged-in non-members. That inconsistency is untouched here.)
Testing
On the local stack, I loaded a public step with accountable, responsible, consulted and informed roles:
mainNo console warnings or errors for any viewer.
svelte-check: 0 errors. Unit tests: 288 passed.🤖 Generated with Claude Code