Skip to content

Conversation

@malwilley
Copy link
Member

@malwilley malwilley commented Nov 18, 2025

Closes ID-1104

  • Disable "create monitor" button on errors page
  • Better tooltip text on error monitor details page
CleanShot 2025-11-18 at 11 23 59 CleanShot 2025-11-18 at 11 24 51

@malwilley malwilley requested a review from a team as a code owner November 18, 2025 19:26
@github-actions github-actions bot added the Scope: Frontend Automatically applied to PRs that change frontend components label Nov 18, 2025
@linear
Copy link

linear bot commented Nov 18, 2025

return hasEveryAccess(['alerts:write'], {organization});
}

return detectorTypeIsUserCreateable(detectorType);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Inconsistent authorization allows monitor creation.

When detectorType is provided and user-createable, the hook returns true without checking the user's alerts:write permission. This allows users without proper permissions to see an enabled "Create Monitor" button for user-createable detector types. The permission check is only performed when detectorType is null, creating an inconsistent authorization check.

Fix in Cursor Fix in Web

),
}
);
const permissionTooltipText = detectorTypeIsUserCreateable(detector.type)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Won't this only show if you're unable to edit the monitor?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh canEdit inherited behavior huh

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nvm I see I think

}
)
: t(
'This monitor is managed by Sentry. Only organization owners and managers can edit it.'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wait, is this right?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now yeah, only org owners/managers can access the edit screen for error monitors

@malwilley malwilley merged commit e6265e4 into master Nov 18, 2025
49 checks passed
@malwilley malwilley deleted the malwilley/feat/disable-error-monitor-create-button branch November 18, 2025 22:38
@github-actions github-actions bot locked and limited conversation to collaborators Dec 4, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Scope: Frontend Automatically applied to PRs that change frontend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants