WEB-844: Hamburguer menu grant-treasurer#3382
Merged
IOhacker merged 1 commit intoopenMF:devfrom Mar 15, 2026
Merged
Conversation
|
Note
|
| Cohort / File(s) | Summary |
|---|---|
Permission Gating for Account Applications src/app/clients/clients-view/clients-view.component.html |
Added mifosxHasPermission directive with multiple CREATE_ permissions to two account applications trigger buttons (header-area and client menu), maintaining existing [matMenuTriggerFor]="accountApplications" functionality. |
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~8 minutes
Possibly related PRs
- WEB-812: Fix the WebApp to show/hide the Menus, Submenus and buttons as per the grants of each profile #3360: Main PR's changes directly rely on the multi-permission support for the has-permission directive introduced in this PR.
- WEB-575 Fix the web-app to show the menus and buttons create import delete edit as per the grants of each profile #3102: Both PRs implement RBAC-based permission gating by adding visibility checks to UI elements through the *mifosxHasPermission directive.
Suggested reviewers
- IOhacker
🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 inconclusive)
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Title check | ❓ Inconclusive | The title 'WEB-844: Hamburguer menu grant-treasurer' is related to the changeset but does not clearly describe the main technical change: adding permission guards to the Applications button. | Consider revising the title to more clearly describe the main change, such as 'Add permission guard to Applications menu button in client hamburger menu' or 'Fix Applications button visibility with RBAC permission checks'. |
✅ Passed checks (2 passed)
| Check name | Status | Explanation |
|---|---|---|
| Description Check | ✅ Passed | Check skipped - CodeRabbit’s high-level summary is enabled. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Create PR with unit tests
- Post copyable unit tests in a comment
📝 Coding Plan
- Generate coding plan for human review comments
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands and usage tips.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/assets/env.js`:
- Line 103: The checked-in default hardcodes RBAC on by setting
window['env']['productionModeEnableRBAC'] = true; change this to a
backward-compatible default (false) and ensure RBAC is enabled only via
runtime/deployment injection (the env.template.js / injection path), i.e.,
update the default assignment for window['env']['productionModeEnableRBAC'] to
false and document or rely on the existing env template mechanism to flip it in
deployments.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 78c857b6-9ba7-47e3-8cfa-a5f64417f658
📒 Files selected for processing (2)
src/app/clients/clients-view/clients-view.component.htmlsrc/assets/env.js
…urer The Applications button in the client hamburger menu was visible to all users regardless of permissions when RBAC is enabled, because only the child items inside the submenu had mifosxHasPermission guards and the parent trigger button had none. Add a combined permission check so the button only renders if the user has at least one of: CREATE_LOAN, CREATE_SAVINGSACCOUNT, CREATE_SHAREACCOUNT, CREATE_RECURRINGDEPOSITACCOUNT, CREATE_FIXEDDEPOSITACCOUNT. Fixed the changes needed for the treasurer role. Closes: WEB-844 fix(env): revert productionModeEnableRBAC default to false for backward compatibility
ansh-varshney
force-pushed
the
WEB-844-fix-tesorero-hamburger-menus
branch
from
db8b9ba to
6da1751
Compare
Contributor
Author
|
Hi @IOhacker, kindly merge the pr if no issues. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JIRA TICKET: WEB-844
Description
Applications button in the client hamburger menu lacked permission guard on the parent trigger button. Child items inside had individual mifosxHasPermission checks, but the parent button always rendered when the client was active, regardless of the user's permissions. When RBAC is enabled, this causes the Applications button to appear even for roles that have none of the application creation permissions.
The treasurer role hamburger menu fix is complete.
Screenshots, if any
Checklist
Please make sure these boxes are checked before submitting your pull request - thanks!
If you have multiple commits please combine them into one commit by squashing them.
Read and understood the contribution guidelines at
web-app/.github/CONTRIBUTING.md.Summary by CodeRabbit