Skip to content

fix(dashboards): Removes edit permission on widget context menu for prebuilt dashboards #160

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(dashboards): Removes edit permission on widget context menu for prebuilt dashboards #160

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions static/app/views/dashboards/dashboard.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ import {IconResize} from 'sentry/icons';
import {t} from 'sentry/locale';
import GroupStore from 'sentry/stores/groupStore';
import {space} from 'sentry/styles/space';
import {defined} from 'sentry/utils';
import {trackAnalytics} from 'sentry/utils/analytics';
import {DatasetSource} from 'sentry/utils/discover/types';
import useApi from 'sentry/utils/useApi';
Expand Down Expand Up @@ -430,6 +431,7 @@ function Dashboard({
onSetTransactionsDataset={() => handleChangeSplitDataset(widget, index)}
isEmbedded={isEmbedded}
isPreview={isPreview}
isPrebuiltDashboard={defined(dashboard.prebuiltId)}
dashboardFilters={getDashboardFiltersFromURL(location) ?? dashboard.filters}
dashboardPermissions={dashboard.permissions}
dashboardCreator={dashboard.createdBy}
Expand Down
17 changes: 10 additions & 7 deletions static/app/views/dashboards/sortableWidget.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ type Props = {
dashboardPermissions?: DashboardPermissions;
isEmbedded?: boolean;
isMobile?: boolean;
isPrebuiltDashboard?: boolean;
isPreview?: boolean;
newlyAddedWidget?: Widget;
onNewWidgetScrollComplete?: () => void;
Expand Down Expand Up @@ -73,18 +74,20 @@ function SortableWidget(props: Props) {
newlyAddedWidget,
onNewWidgetScrollComplete,
useTimeseriesVisualization,
isPrebuiltDashboard = false,
} = props;

const organization = useOrganization();
const currentUser = useUser();
const {teams: userTeams} = useUserTeams();
const hasEditAccess = checkUserHasEditAccess(
currentUser,
userTeams,
organization,
dashboardPermissions,
dashboardCreator
);
const hasEditAccess =
checkUserHasEditAccess(
currentUser,
userTeams,
organization,
dashboardPermissions,
dashboardCreator
) && !isPrebuiltDashboard;
Comment on lines +83 to +90
Copy link

@propel-test-bot propel-test-bot bot Nov 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[BestPractice]

The hasEditAccess logic now prevents editing on prebuilt dashboards by adding && !isPrebuiltDashboard to the permission check. This implementation looks correct and follows the existing permission pattern.

However, consider if this is the right place for this check. Currently, prebuilt dashboards will show as having edit access in the checkUserHasEditAccess function but then have it revoked at the component level. If prebuilt dashboards should never be editable regardless of user permissions, it might be cleaner to include this check inside the checkUserHasEditAccess utility function itself.

Current approach:

const hasEditAccess =
  checkUserHasEditAccess(...) && !isPrebuiltDashboard;

Alternative approach (in checkUserHasEditAccess function):

export function checkUserHasEditAccess(
  currentUser: User,
  userTeams: Team[],
  organization: Organization,
  dashboardPermissions?: DashboardPermissions,
  dashboardCreator?: User,
  isPrebuiltDashboard?: boolean
): boolean {
  if (isPrebuiltDashboard) {
    return false;
  }
  // ... rest of existing logic
}

This would centralize the permission logic and make it clear that prebuilt dashboards are never editable.

Context for Agents 
The `hasEditAccess` logic now prevents editing on prebuilt dashboards by adding `&& !isPrebuiltDashboard` to the permission check. This implementation looks correct and follows the existing permission pattern.

However, consider if this is the right place for this check. Currently, prebuilt dashboards will show as having edit access in the `checkUserHasEditAccess` function but then have it revoked at the component level. If prebuilt dashboards should never be editable regardless of user permissions, it might be cleaner to include this check inside the `checkUserHasEditAccess` utility function itself.

Current approach:
```typescript
const hasEditAccess =
  checkUserHasEditAccess(...) && !isPrebuiltDashboard;
```

Alternative approach (in `checkUserHasEditAccess` function):
```typescript
export function checkUserHasEditAccess(
  currentUser: User,
  userTeams: Team[],
  organization: Organization,
  dashboardPermissions?: DashboardPermissions,
  dashboardCreator?: User,
  isPrebuiltDashboard?: boolean
): boolean {
  if (isPrebuiltDashboard) {
    return false;
  }
  // ... rest of existing logic
}
```

This would centralize the permission logic and make it clear that prebuilt dashboards are never editable.

File: static/app/views/dashboards/sortableWidget.tsx
Line: 90


const disableTransactionWidget =
organization.features.includes('discover-saved-queries-deprecation') &&
Expand Down
Loading