feat(connections): tenant-wide connection sharing — admin provisions, all use by alfredo1996 · Pull Request #1018 · alfredo1996/neoboard

alfredo1996 · 2026-06-11T03:03:38Z

What

Closes #901 (charter decision: admin provisions, all use — the Metabase/Superset/Looker model).

Today every creator must own a copy of every connection, meaning admins hand out database credentials. This PR adds a visibility flag (private | shared) so an admin can share a connection workspace-wide: everyone in the tenant can query it and build dashboards on it, while credentials never leave the server and management stays owner/admin-only.

Behavior

Surface	private (default)	shared
/api/query fast path	owner only	every tenant user
Connections list / GET [id]	owner + admin	everyone (metadata only, `isOwner` flag, never the owner id)
Schema/databases introspection	owner	everyone (editor autocomplete works)
Edit / delete / test / share toggle	owner + admin	owner + admin only — others see a read-only card
Visibility changes	—	admin-only, owner-scoped

ConnectionCard gains a Shared badge + visibility-toggle menu item (pure UI props — component package stays logic-free)
Migration 0008: enum column, default private → zero behavior change for existing rows
Interplay with [P1] security: /api/query dashboard fallback allows arbitrary read queries against any referenced connection #972: un-sharing drops non-owners back to dashboard-bound access (verified end-to-end)

Tests

5 new/updated route tests (list marks shared rows + hides owner id; [id] shared read; PATCH visibility 403 for non-admins / applied for admins)
New connection-sharing.spec.ts (5 serial E2E tests): private invisibility → admin shares via card menu → creator sees read-only card with badge + queries directly (200) → creator PATCH rejected (403) → admin un-shares and creator's arbitrary query falls to dashboard-bound 403 ([P1] security: /api/query dashboard fallback allows arbitrary read queries against any referenced connection #972)

Verification

App unit 2901 ✓ · component 1383 ✓ · lint 0 ✓ · build ✓ · migration generated via drizzle-kit
connection-sharing.spec 5/5 on fresh containers
Full local Playwright: 294 passed + 23 retry-passes; 20 residuals decomposed by a targeted fresh-container run of every suspicious family (form-widget + transforms + sharing together): 18/18 passed + 2 retry-passes, zero failures — full-run residuals were machine contention (documented [P2] e2e: alice's row vanishes from the tenant-filtered users list mid-run — remaining users.spec full-run cluster #1004 pattern)

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

New Features
- Connection sharing: Team members can now share database connections with the workspace, enabling colleagues to query shared connections read-only.
- Ownership and permissions: Connection owners control sharing status and management actions; non-owners access shared connections as read-only.
- "Shared" badge displays on shared connection cards for easy identification.

… all use (#901) Connections gain a visibility flag (private | shared): - shared connections are first-class queryable for every tenant user (query route fast path) and visible in the connections list and schema/databases introspection — creators no longer need their own copy of every credential - credentials never leave the server for anyone; the owner id is exposed only as an isOwner boolean - visibility changes are admin-only and owner-scoped (admins share connections they own — the 'admin provisions' model) - non-owners see shared connections read-only: no edit/delete/test/ share menu at all - ConnectionCard gains a Shared badge and a visibility toggle item (pure UI props, no business logic in the component package) Migration 0008 adds the enum column (default private — no behavior change for existing rows). E2E: connection-sharing.spec walks the full lifecycle — private invisibility, admin share, creator read-only view + direct query, non-admin toggle rejection (403), unshare dropping the creator back to dashboard-bound access (403 via #972). Per the 2026-06-11 overnight charter decision: 'Admin provisions, all use'. Closes #901 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

coderabbitai · 2026-06-11T03:03:50Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 77d4b5b6-4b8d-44c1-982f-6d62c238b7ac

📥 Commits

Reviewing files that changed from the base of the PR and between 42fac58 and 540976d.

⛔ Files ignored due to path filters (3)

app/drizzle/migrations/0008_lumpy_jubilee.sql is excluded by !app/drizzle/migrations/**
app/drizzle/migrations/meta/0008_snapshot.json is excluded by !app/drizzle/migrations/**
app/drizzle/migrations/meta/_journal.json is excluded by !app/drizzle/migrations/**

📒 Files selected for processing (13)

app/e2e/connection-sharing.spec.ts
app/src/app/(dashboard)/connections/page.tsx
app/src/app/api/connections/[id]/__tests__/route.test.ts
app/src/app/api/connections/[id]/databases/route.ts
app/src/app/api/connections/[id]/route.ts
app/src/app/api/connections/[id]/schema/route.ts
app/src/app/api/connections/__tests__/route.test.ts
app/src/app/api/connections/route.ts
app/src/app/api/query/route.ts
app/src/hooks/use-connections.ts
app/src/lib/db/schema.ts
app/src/lib/shared/schemas.ts
component/src/components/composed/connection-card.tsx

Walkthrough

This PR implements Option B from issue #901: a per-connection visibility model. Connections default to "private" (owner/admin-only) and admins can mark them "shared" to allow all tenant users read-only query and dashboard access. Non-owners cannot modify visibility; isOwner is derived server-side to prevent raw ownerId exposure.

Changes

Connection visibility and tenant sharing

Layer / File(s)	Summary
Database schema and type contracts `app/src/lib/db/schema.ts`, `app/src/lib/shared/schemas.ts`, `app/src/hooks/use-connections.ts`	Adds `connectionVisibilityEnum` ("private" / "shared") to the connections table with "private" default; updates `ConnectionListItem` to include `visibility` and `isOwner` boolean; extends `UpdateConnectionInput` and validation schema to support optional admin-only `visibility` field.
API authorization and response shaping across routes `app/src/app/api/connections/route.ts`, `app/src/app/api/connections/[id]/route.ts`, `app/src/app/api/connections/[id]/databases/route.ts`, `app/src/app/api/connections/[id]/schema/route.ts`, `app/src/app/api/query/route.ts`	All routes now authorize access for both owned and shared (`visibility="shared"`) connections within the tenant; GET routes select `visibility` and `ownerId`, reshape responses to expose `isOwner` instead of raw `ownerId`, and return via `apiList`; PATCH blocks non-admin `visibility` updates with 403 forbidden.
ConnectionCard component UI `component/src/components/composed/connection-card.tsx`	Adds `shared` boolean prop to conditionally render "Shared" badge with Users icon; introduces `onToggleVisibility` callback and `toggleVisibilityLabel` ("Share with workspace" default) to add a dropdown menu item for toggling visibility.
Connections page integration `app/src/app/(dashboard)/connections/page.tsx`	Derives `isAdmin` from session; gates `onTest`, `onEdit`, `onDelete`, `onDuplicate`, and visibility toggle callbacks on `c.isOwner \|\| isAdmin`, providing read-only UI for non-owners of shared connections.
API authorization and response tests `app/src/app/api/connections/[id]/__tests__/route.test.ts`, `app/src/app/api/connections/__tests__/route.test.ts`	Validates GET response metadata (`isOwner` derived, `ownerId` omitted), non-owner access to tenant-shared connections, admin-only PATCH visibility enforcement (non-admin → 403), and admin visibility updates with payload verification.
E2E workflow test `app/e2e/connection-sharing.spec.ts`	Full serial lifecycle test: private visibility hides from non-owner, share toggle shows "Shared" badge, non-owner sees read-only card without action menu, non-owner can query shared connection but cannot PATCH visibility, unshare revokes read access with 403 fallback.

Sequence Diagram(s)

sequenceDiagram
    participant Admin as Admin (ALICE)
    participant NonOwner as Non-owner (BOB)
    participant UI
    participant API as GET /api/connections
    participant DB
    
    Admin->>UI: private connection created
    NonOwner->>API: list connections (tenantId=T)
    API->>DB: where (userId=BOB or visibility="shared") and tenantId=T
    DB-->>API: [] (connection not shared yet)
    API-->>NonOwner: empty list
    
    Admin->>UI: click "Share with workspace"
    UI->>API: PATCH /api/connections/[id] {visibility: "shared"}
    API->>DB: UPDATE visibility="shared" where id=X
    DB-->>API: OK
    
    NonOwner->>API: list connections (tenantId=T)
    API->>DB: where (userId=BOB or visibility="shared") and tenantId=T
    DB-->>API: [{id, visibility: "shared", ownerId: ALICE_ID}]
    API->>API: isOwner = (ALICE_ID === BOB) = false
    API-->>NonOwner: [{id, visibility: "shared", isOwner: false}]
    NonOwner->>UI: shows "Shared" badge, read-only

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

alfredo1996/neoboard#633: Extends the /api/connections/[id]/databases route authorization to match the new owner-or-shared pattern introduced in this PR's main implementation.
alfredo1996/neoboard#579: Prior work on the /api/query fast-path connection authorization; this PR builds on that by adding the visibility="shared" branch to the same query checkpoint.

Suggested labels

pkg:connection, testing

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/issue-901-connection-visibility

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

sonarqubecloud · 2026-06-11T03:11:56Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

alfredo1996 added enhancement New feature or request security Security-related issue pkg:app Next.js application package pkg:component UI component library area:auth Authentication & authorization area:connectors Database connectors labels Jun 11, 2026

alfredo1996 merged commit 6752289 into release/1.1 Jun 11, 2026
10 of 11 checks passed

alfredo1996 deleted the feat/issue-901-connection-visibility branch June 11, 2026 03:04

alfredo1996 mentioned this pull request Jun 11, 2026

[Discussion] Connection visibility model: should non-admins see shared connections? #901

Closed

Navigation Menu

feat(connections): tenant-wide connection sharing — admin provisions, all use - #1018

feat(connections): tenant-wide connection sharing — admin provisions, all use#1018
alfredo1996 merged 1 commit into
release/1.1from
feat/issue-901-connection-visibility

alfredo1996 commented Jun 11, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

Review failed

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jun 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

alfredo1996 commented Jun 11, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Behavior

Tests

Verification

Summary by CodeRabbit

Release Notes

Uh oh!

coderabbitai Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Suggested labels

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jun 11, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

alfredo1996 commented Jun 11, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading