fix(app-admin): merge permission groups by name#5338
Merged
Conversation
app-graphql-playground and app-sdk-playground each declared the full "dev-tools" permission group with both entities, because same-name registrations overwrite each other in the PropertyStore (last write wins), so each app shipped both entities to ensure the surviving one was complete. Each app now declares only its own entity. SecurityPermissions makes each registration id unique by appending the contributed entity ids, and Permissions merges renderers that share a group name (concatenating their entities, deduped by id) at render time. This also fixes a latent duplicate React key when two renderers shared a name. Also ignore the local .nx cache directory. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
adrians5j
force-pushed
the
adrian/admin-dedupe-sec-permissions-2026-06-29
branch
from
c21fbd0 to
9d6796d
Compare
adrians5j
changed the title
adrians5j
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Previously the GraphQL Playground and SDK Playground apps each declared the entire "Dev Tools" permission group — including the other app's entity — because permission groups registered under the same name overwrote one another, so each app had to ship the full list to stay complete. This meant an admin could see (and toggle) a permission for an app that wasn't even installed.
Now each app declares only its own entity. The admin permissions UI merges all contributions that share a group name into a single "Dev Tools" group, combining their entities. Installing either playground (or both) shows exactly the right set of permissions, and any future dev tool can add its own entity without touching the others.
Changelog
Dev Tools permissions no longer duplicated across playground apps
The GraphQL Playground and SDK Playground apps each used to register the other app's permissions as well as their own, which could show permissions for apps that weren't installed. Each app now contributes only its own permissions, and they're combined into a single "Dev Tools" group automatically.
Squash Merge Commit