feat(FR-2209): scope admin serving by project for project admins#6652
Conversation
How to use the Graphite Merge QueueAdd either label to this PR to merge it via the merge queue:
You must have a Graphite account in order to use the merge queue. Sign up using this link. An organization admin has required the Graphite Merge Queue in this repository. Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue. This stack of pull requests is managed by Graphite. Learn more about stacking. |
Coverage report for
|
St.❔ |
Category | Percentage | Covered / Total |
|---|---|---|---|
| 🔴 | Statements | 9.02% (-0% 🔻) |
1770/19631 |
| 🔴 | Branches | 8.14% (-0% 🔻) |
1115/13697 |
| 🔴 | Functions | 5.36% | 286/5335 |
| 🔴 | Lines | 8.71% (-0% 🔻) |
1660/19062 |
Test suite run success
859 tests passing in 39 suites.
Report generated by 🧪jest coverage report action from 71ef875
There was a problem hiding this comment.
Pull request overview
Adds project-level scoping to the Admin Serving page’s endpoint listing so project admins can be restricted to the currently selected project (while keeping broader visibility for higher admin roles until backend domain-scope support lands).
Changes:
- Derives an effective admin role and current project ID in
ServingTabContent. - Passes an optional
projectvariable into theendpoint_listGraphQL query to scope results forprojectAdmin. - Updates memoized query variables/dependencies to include the project filter.
| // Relay node. Leave unfiltered for domainAdmin until backend support lands. | ||
| // TODO(needs-backend): FR-2313 — domain-scope RBAC for endpoint_list | ||
| const projectFilter = | ||
| effectiveRole === 'projectAdmin' ? (currentProject.id ?? null) : null; |
There was a problem hiding this comment.
projectFilter uses null for the “no project filter” case, which means $project is always sent to GraphQL as an explicit null. Elsewhere in the codebase, endpoint_list optional project scoping is typically omitted by leaving the variable undefined (e.g., react/src/components/Chat/EndpointSelect.tsx:137-140 passes only {limit: 10}), which avoids any backend behavior differences between “arg omitted” vs “arg provided as null”. Consider changing the non-projectAdmin branch to undefined (and keeping the variable optional) so Relay omits $project entirely when unscoped.
| effectiveRole === 'projectAdmin' ? (currentProject.id ?? null) : null; | |
| effectiveRole === 'projectAdmin' ? (currentProject.id ?? undefined) : undefined; |
| const projectFilter = | ||
| effectiveRole === 'projectAdmin' ? (currentProject.id ?? null) : null; |
There was a problem hiding this comment.
For effectiveRole === 'projectAdmin', projectFilter falls back to null when currentProject.id is missing. That would result in an unscoped endpoint_list query for a project admin, undermining the intended “scope by project” behavior. Consider blocking the query (or returning an empty state) until currentProject.id is available, or keep projectFilter as undefined/throw when it’s unexpectedly absent for project admins.
25f9613 to
71ef875
Compare

resolves #NNN (FR-MMM)
Checklist: (if applicable)