Skip to content

Fix/2155 - #323

Merged
conradmugabe merged 5 commits into
mainfrom
fix/2155
Jul 24, 2026
Merged

Fix/2155#323
conradmugabe merged 5 commits into
mainfrom
fix/2155

Conversation

@conradmugabe

@conradmugabe conradmugabe commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Checklist

  • Tests were added/updated according to the feature/bugfix/change made
  • Version was rolled according to semver requirements
  • API endpoints openapi schema was updated if applicable

Changes

  • Allow a user who has a shareable token to chat without checking RBAC permissions. When an admin shares an admin-only agent with a shareable token. The application does not check for the RBAC permission, allowing the user to chat.
  • Closes https://github.com/iblai/iblai-platform/issues/2155

Screenshots

Screencast.from.2026-07-24.03-21-10.mp4

@conradmugabe
conradmugabe requested a review from sonegillis1 July 10, 2026 17:26
@conradmugabe
conradmugabe requested a review from mamigot as a code owner July 10, 2026 17:26
@mamigot

mamigot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Claude finished @conradmugabe's task —— View job

E2E Coverage Review

  • Dismiss stale REQUEST_CHANGES reviews (none found)
  • Identify changed files — only component files changed, no new page.tsx routes
  • Run mechanical coverage check — passed (545 checkpoints, 25/25 files covered)
  • Read current coverage state — all existing coverage intact
  • Applied decision logic — CASE E: No new routes, mechanical check passed → Approved

Result: ✅ PR approved. No new app routes were introduced and all existing coverage (545 checkpoints) remains intact.

mamigot
mamigot approved these changes Jul 10, 2026
View reviewed changes

@mamigot mamigot left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ E2E Coverage — No Issues

No new app routes were introduced. All existing coverage is intact.

@conradmugabe conradmugabe added the run-tests Trigger PR validation pipeline label Jul 13, 2026
conradmugabe and others added 5 commits July 23, 2026 19:28
@conradmugabe @claude
fix(chat): let shareable-link sessions bypass the RBAC chat gate
55501d3 
A visitor arriving via a shareable link (`?token=...`) should be able to
chat regardless of RBAC. The backend validates the token on session
creation and only returns a sessionId when it accepts it, so a token
paired with an active session bypasses the RBAC chat gate. A token alone
is not enough (invalid token, or the brief window before create-session
resolves), so the input stays gated until the session exists. The RBAC
"no permission" placeholder is suppressed whenever a token is present,
since RBAC does not apply to share-link visitors.

Also extract `isSendDisabled` (RBAC gate + active session) to replace the
duplicated `isChatDisabledByRbac || !sessionId` check across the submit
guard and send/tool buttons, and add unit coverage for the bypass. This
also repairs the chat-input-form test suite, which was failing on main
for lack of next/navigation and useChatPrivacy mocks.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@conradmugabe @claude
style: normalize pre-existing CHANGELOG prettier drift
2fe046a 
The pre-commit hook runs prettier over the whole tree; CHANGELOG.md on main
uses `*` list bullets which prettier rewrites to `-`. Isolate that unrelated
reformat here so it stays out of the journey 64 test commits.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@conradmugabe @claude
test(e2e): add embed access-control and shareable-link page-object he…
508bb74 
…lpers

Extend EmbedTab with the helpers journey 64 needs to drive the Embed tab's
access controls end-to-end: setWhoCanView/setWhoCanChat (Radix Select option
resolution), the shareableLinkUrlBlock/whoCanViewSelect/whoCanChatSelect
locators, and enableShareableLink/getShareableLinkUrl/getShareableLinkToken
for minting and reading a shareable link. Reuses the existing
getShareableLinkState/toggleShareableLink primitives.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@conradmugabe @claude
test(e2e): add journey 64 shareable-link RBAC bypass
e852557 
Cover issue #2155: a shareable-link ?token= lets a non-admin who lacks the
RBAC #chat permission chat, but only once the backend accepts the token and a
session is created. Three checkpoints against a live backend, each
provisioning its own Administrators-view / Authenticated-Users-chat mentor via
the Embed tab: valid token enables chat (shl-01), invalid token stays disabled
(shl-02, token presence alone must not unlock), no token stays disabled with
the RBAC denial placeholder (shl-03). Non-landing is a hard failure — the
suite never treats a flow that didn't reach its deterministic state as a pass.
Mentors are reaped via MentorTracker + the name-pattern sweeper backstop.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@conradmugabe @claude
test(e2e): record journey 64 coverage
c4e4127 
Add the shareable-link-rbac-bypass journey (shl-01..03) to coverage.json and
COVERAGE.md and refresh the summary totals.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@mamigot

mamigot commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Claude finished @conradmugabe's task —— View job

E2E Coverage Review

  • Dismiss stale REQUEST_CHANGES reviews (none found)
  • Identify changed files — only component files changed, no new page.tsx routes
  • Run mechanical coverage check — passed (583 → 586 checkpoints, +3 improved)
  • Read current coverage state — all existing coverage intact
  • Applied decision logic — CASE E: No new routes, mechanical check passed → Approved

Result: ✅ PR approved. No new app routes were introduced and coverage improved from 583 to 586 checkpoints (+3).

View job

mamigot
mamigot approved these changes Jul 24, 2026
View reviewed changes

@mamigot mamigot left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ E2E Coverage — No Issues

No new app routes were introduced. All existing coverage is intact.

@conradmugabe conradmugabe self-assigned this Jul 24, 2026
@conradmugabe
conradmugabe merged commit 58cd842 into main Jul 24, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mamigot mamigot mamigot approved these changes
@sonegillis1 sonegillis1 sonegillis1 approved these changes

Assignees

@conradmugabe conradmugabe

Labels

run-tests Trigger PR validation pipeline

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@conradmugabe @mamigot @sonegillis1