fix: grant member role read access to knowledge resources

[Israeltheminer]

Fixes #758

Summary

• Add knowledgeRead UI permission subject; grant it to editor and member roles so all non-disabled users can view knowledge resources
• Switch the knowledge layout access gate from knowledgeWrite to knowledgeRead
• Gate row actions (edit/delete) behind knowledgeWrite — read-only users see no action column in knowledge tables
• Update access-denied message to be role-agnostic
• Add ability.test.ts with unit tests for the permission system
• Fix action column width (56px) across customers, products, vendors tables

Test plan

• Log in as a member role user → knowledge section is accessible and readable
• Log in as a member role user → no action column shown in knowledge tables
• Log in as an editor role user → edit/delete actions appear for supported resources
• Log in as a disabled user → access-denied message shown
• Run bun run --filter @tale/platform test → ability.test.ts passes

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Permission-based access controls implemented across modules; users can only see edit/delete actions based on write permissions.
  • Inline view dialogs now open when clicking table rows, replacing action button views.

• Improvements

  • Knowledge section access now requires read permission instead of write permission.
  • Updated error messaging for permission denials.

• UI/UX

  • Action column widths optimized.
  • Button styling enhancements applied.

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR implements permission-based access controls across multiple knowledge management features. It introduces a new knowledgeRead permission variant to the CASL ability system, adds useAbility hook invocations throughout UI components for read/write access gating, relocates view functionality from row action dropdowns to table row click handlers, adjusts table action column widths, and updates the knowledge route access requirement from write to read permissions. The changes systematically restrict component rendering and action visibility based on computed ability checks while maintaining existing UI structures.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• feat: replace string-based role checks with CASL ability system #519: Introduces the CASL ability system framework (AbilityContext, useAbility hook, ability types) that is being extended throughout this PR with knowledgeRead variant and component-level ability checks.
• feat: UI updates and automation enhancements #275: Modifies services/platform/app/components/ui/data-table/data-table-filters.tsx where this PR also updates button styling, indicating concurrent or sequential work on the same component.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The PR includes several out-of-scope changes unrelated to issue #758: action column width fixes across customers, products, vendors tables (56px) are styling adjustments not required by the linked issue.	Consider separating action column width adjustments into a separate PR or clearly document why these changes are necessary for the knowledge access feature.
Docstring Coverage	⚠️ Warning	Docstring coverage is 15.38% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title 'fix: grant member role read access to knowledge resources' clearly and concisely describes the main objective of the changeset.
Linked Issues check	✅ Passed	The PR successfully addresses issue #758 by introducing knowledgeRead permission, granting it to member/editor roles, and changing the knowledge layout gate from knowledgeWrite to knowledgeRead, which ensures members can access knowledge while preserving write-only actions.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/knowledge-member-access

📝 Coding Plan

• Generate coding plan for human review comments

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@services/platform/app/features/customers/components/customer-row-actions.tsx`:
- Around line 27-29: The canEdit early-return makes the per-action "visible:
canEdit" flags redundant; remove the visible properties from the edit and delete
action objects in customer-row-actions.tsx (the action entries that build the
edit and delete menu items) and rely on the existing early return that checks
canEdit before rendering EntityRowActions; keep the canEdit calculation and the
early return in place and only eliminate the duplicate visible: canEdit fields
to clean up the logic.

In `@services/platform/app/features/customers/components/customers-table.tsx`:
- Around line 189-210: The DataTable uses onRowClick (handleRowClick) to open
CustomerInfoDialog via setViewingCustomer, which prevents keyboard users from
opening rows; update the interaction so keyboard activation (Enter/Space)
triggers the same flow: either extend DataTable to accept an
onRowKeyDown/onRowAction prop and wire it to call handleRowClick (or
setViewingCustomer) for Enter/Space, or add an onKeyDown handler where DataTable
is used that listens for Enter/Space and calls handleRowClick(viewingRow) —
ensure the row elements are focusable (tabIndex=0) and keep CustomerInfoDialog
usage (viewingCustomer, onOpenChange) unchanged so both mouse click and keyboard
activation open the dialog.

In `@services/platform/app/features/products/components/product-row-actions.tsx`:
- Around line 66-67: The action menu is still visible to read-only users when
hasExternalLink is true because some visibility props use "canWrite ||
hasExternalLink"; update those visibility expressions (the visible prop
assignments referencing canWrite and hasExternalLink in product-row-actions.tsx)
to require canWrite unconditionally (e.g., visible: canWrite) so that if
canWrite is false the action column is hidden even when hasExternalLink is true;
locate every occurrence where visible uses a disjunction with hasExternalLink
and change it to only depend on canWrite.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: cc2e06e3-b02a-4771-b34c-04cea83ffe93

📥 Commits

Reviewing files that changed from the base of the PR and between 5c0c819 and a4a9cdb.

📒 Files selected for processing (21)

• services/platform/app/components/ui/data-table/data-table-filters.tsx
• services/platform/app/features/customers/components/customer-row-actions.tsx
• services/platform/app/features/customers/components/customers-action-menu.tsx
• services/platform/app/features/customers/components/customers-table.tsx
• services/platform/app/features/customers/hooks/use-customers-table-config.tsx
• services/platform/app/features/documents/components/document-row-actions.tsx
• services/platform/app/features/documents/components/documents-action-menu.tsx
• services/platform/app/features/documents/components/rag-status-badge.tsx
• services/platform/app/features/documents/hooks/use-documents-table-config.tsx
• services/platform/app/features/products/components/product-row-actions.tsx
• services/platform/app/features/products/components/products-action-menu.tsx
• services/platform/app/features/products/components/products-table.tsx
• services/platform/app/features/products/hooks/use-products-table-config.tsx
• services/platform/app/features/vendors/components/vendor-row-actions.tsx
• services/platform/app/features/vendors/components/vendors-action-menu.tsx
• services/platform/app/features/vendors/components/vendors-table.tsx
• services/platform/app/features/vendors/hooks/use-vendors-table-config.tsx
• services/platform/app/routes/dashboard/$id/_knowledge.tsx
• services/platform/lib/permissions/ability.test.ts
• services/platform/lib/permissions/ability.ts
• services/platform/messages/en.json