feat(FR-2525): add project-admin tier to admin menu and project selector

[yomybaby]

Resolves #6644 (FR-2552)

Part of FR-2209 Project Admin Management stack (PR-1a).
Stacks on #6651.

Summary

• useWebUIMenuItems now gates admin-category keys by useEffectiveAdminRole(); project admins see only Session/Serving/Data/Members
• WebUISider uses 3-tier hasAdminCategoryRole = useEffectiveAdminRole() !== 'none'
• ProjectSelect renders a "Project Admin" badge on admin-scoped projects for project-admin-only users

Verification

• bash scripts/verify.sh -> === ALL PASS ===

[yomybaby]

• feat(FR-2525): add project-admin tier to admin menu and project selector #6653 : 2 dependent PRs (#6656 , #6657 ) 👈 (View in Graphite)
• feat(FR-2555): add useCurrentUserProjectRoles hook with myRoles RBAC query #6651 : 3 other dependent PRs (#6652 , #6654 , #6655 )
• main

---

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

• flow:merge-queue - adds this PR to the back of the merge queue
• flow:hotfix - for urgent changes, fast-track this PR to the front of the merge queue

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has required the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Coverage report for ./react

St.❔	Category	Percentage	Covered / Total
🔴	Statements	9.01% (-0% 🔻)	1771/19647
🔴	Branches	8.13% (-0.01% 🔻)	1115/13708
🔴	Functions	5.38% (+0.02% 🔼)	287/5337
🔴	Lines	8.71% (-0% 🔻)	1661/19076

Test suite run success

859 tests passing in 39 suites.

Report generated by 🧪jest coverage report action from 8f0d619

[Copilot]

Pull request overview

Adds UI support for a new “project-admin” tier by (1) adjusting Admin menu visibility/gating and (2) showing a “Project Admin” badge in the project selector, backed by a new i18n string.

Changes:

• Added projectSelect.ProjectAdminBadge translation key (en/ko).
• Introduced useEffectiveAdminRole()-based gating for the Admin category/menu in useWebUIMenuItems and WebUISider.
• Updated ProjectSelect option rendering to display a per-project “Project Admin” badge.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
resources/i18n/en.json	Adds English translation for the Project Admin badge label.
resources/i18n/ko.json	Adds Korean translation for the Project Admin badge label.
react/src/hooks/useWebUIMenuItems.tsx	Adds project-admin tier menu filtering and exports project-admin page key list.
react/src/components/ProjectSelect.tsx	Displays a “Project Admin” badge next to projects where the user has project-admin scope.
react/src/components/MainLayout/WebUISider.tsx	Shows Admin Settings entry for any effective admin role (including project admin).

[yomybaby]

Review Summary — PR #6653 (FR-2209 PR-1a)

Verification: bash scripts/verify.sh → === ALL PASS === confirmed locally.

Spec compliance (FR-2314 / FR-2209 PR-1a)

Criterion	Status
Project-admin-only user sees Admin menu category	PASS (via hasAdminCategoryRole = useEffectiveAdminRole() !== 'none' in WebUISider.tsx:58)
Project admin sees only Session/Serving/Data/Members pages	PARTIAL — filtering logic correct (useWebUIMenuItems.tsx:486-493); admin-members key is forward-declared but no menu item emits that key yet (delivered in PR-2d)
Domain admin / superadmin always see Admin menu	PASS
Badge shows on admin projects for project-admin users only	PASS (shouldShowProjectAdminBadge === 'projectAdmin' gating on ProjectSelect.tsx:55)

Findings

🟠 HIGH — Route-guard mismatch for project admins (spec-deferred)

File: react/src/hooks/useWebUIMenuItems.tsx:807-828 (isCurrentPageUnauthorized)

The unauthorized check still uses legacy currentUserRole only. A project-admin user (with baiClient.is_admin === false) who clicks /admin-session from the menu will render as 401 Unauthorized because the branch currentUserRole !== 'admin' && currentUserRole !== 'superadmin' && ALL_ADMIN_PAGE_KEYS.has(...) fires before reading effectiveAdminRole.

This creates a menu-vs-page inconsistency: the item is visible (PR-1a) but the page refuses to render. Likely intended to be resolved together with the project-scoping work in PR-2a/2c (and the new PR-2d for members), but not called out in dev-plan.md PR-1a acceptance criteria. Recommend either:

1. Document as a known gap deferred to PR-2a (acceptable per Graphite-stack sequencing).
2. Or extend this check now: !((currentUserRole === 'admin') || (currentUserRole === 'superadmin') || (PROJECT_ADMIN_PAGE_KEY_SET.has(currentMenuKey) && effectiveAdminRole === 'projectAdmin')).

Given spec scope is honored strictly, flagging as HIGH but not auto-fixing in this PR.

🟡 MEDIUM — admin-members key is a forward declaration

File: react/src/hooks/useWebUIMenuItems.tsx:150

'admin-members' is included in PROJECT_ADMIN_PAGE_KEYS but:

• Not present in VALID_MENU_KEYS (type MenuKeys does not include it — type cast on filter relies on a loose item.key as string which is fine but the canonical source drifts from the key set).
• Not present in ALL_ADMIN_PAGE_KEYS (so the 401 guard won't treat it as an admin route).
• No item in fullAdminMenu emits this key.

Comment (lines 141-145) flags this as intentional scaffolding for PR-2d — acceptable, but consider either adding to VALID_MENU_KEYS now to keep the single-source-of-truth intact, or moving PROJECT_ADMIN_PAGE_KEYS to the PR that introduces the page.

🟡 MEDIUM — UUID short-ID collision window

File: react/src/components/ProjectSelect.tsx:60-64 / useCurrentUserProjectRoles.ts:62-68

Short IDs are first 8 hex chars of a UUID (32-bit space). For a single user with ≤20 projects the birthday-collision probability is <1e-7, so practically safe. However, since the primary scopeId path already carries the full UUID (only the role-name regex fallback needs 8 hex), the hook's contract throws away precision that is otherwise available. Suggest (out of scope here, but as tech-debt for PR-0): emit a projectAdminUuids: string[] alongside projectAdminIds when the primary path is used, and compare full UUIDs in ProjectSelect.tsx. Set.has(short) there effectively downgrades to the fallback's precision.

Not blocking PR-1a; noted for a future cleanup on the base hook.

🟢 LOW — Redundant hook calls in ProjectSelect.tsx

File: react/src/components/ProjectSelect.tsx:50-51

Both useCurrentUserProjectRoles() and useEffectiveAdminRole() are called. The latter internally calls the former, so Relay runs useLazyLoadQuery twice (cache-shared, so no extra network, but two subscriptions). Consolidate:

const { projectAdminIds, isSuperAdmin, domainAdminDomains } =
  useCurrentUserProjectRoles();
const shouldShowProjectAdminBadge =
  !isSuperAdmin && domainAdminDomains.length === 0 && projectAdminIds.length > 0;

🟢 LOW — Tag vs BAITag in ProjectSelect.tsx:154-159

Project uses BAITag (outline, SM radius) for chip-style labels. This PR uses the raw Ant Tag with color="processing" for a filled blue badge — the chosen look is deliberate (high visibility inside a dropdown option), and BAITag would not render with the same prominence. Acceptable; mentioning only to confirm the decision was intentional.

Project-convention checks

• 'use memo' preserved on WebUISider (line 46) and useWebUIMenuItems (line 204). ProjectSelect has no 'use memo' — it also didn't before this PR, so no regression (separate follow-up opportunity).
• Ant Design v6 props: no deprecated prop usage in the diff.
• i18n convention (camelCase namespace projectSelect + PascalCase leaf ProjectAdminBadge): correct. Other languages deferred to FR-2558 as noted.
• Security: client-side menu gating only; backend RBAC is the true gate — acceptable since no privileged action depends solely on menu visibility.

Auto-fix decision

No CRITICAL findings; HIGH finding is spec-deferred per dev-plan.md. Not auto-fixing. Recommend the HIGH item be addressed in PR-2a (or earlier if agreed).

Label: status:review applied.

[graphite-app]

Merge activity

• Apr 14, 8:40 AM UTC: yomybaby added this pull request to the Graphite merge queue.
• Apr 14, 8:44 AM UTC: Merged by the Graphite merge queue.