#1151 Granular RBAC part 5: frontend for roles, tiers, sensitive tags and paths Pull request opened by javuto Granular RBAC part 5: frontend for roles, tiers, sensitive tags and paths Problem Parts 1–4 added global roles (#1144), query/carve tiers with tag grants (#1146), sensitive nodes (#1147) and sensitive carve paths (#1149, #1150). The SPA still only knew "superuser" and the old per-environment on/off flags. That left two problems: • A user admin, environment manager, read-only admin or alert admin got the wrong navigation, and some pages showed controls the server refuses. • Operators had no way to set tiers, tag grants, global roles, sensitive tags or sensitive paths without calling the API by hand. What changes Access module.

frontend/src/lib/access.ts

(plus

useMe

) turns

/api/v1/users/me

into capabilities that mirror the server: •

canSeePage

and

canWritePage

, per page and role. •

envCaps(me, env)

, returning view, query, carve and manage, with tiers included. •

canLogContentRule

, for full query tier or env admin in the rule's environment, never all environments. •

isSuperuser

and

isReadOnlyAdmin

. Every ad-hoc

me.admin

and per-environment permission check now goes through it. A failed or pending

/users/me

hides write controls. Navigation and pages. • Admin menu: each link shows according to its role. Users is visible to read-only admins and editable by user admins. Environments is visible to read-only admins, with create for environment managers. Alerts is for alert admins and read-only admins. Health, the full audit trail and vulnerability feeds are for read-only admins. Settings, service config, log sinks, extensions, osquery versions and auth providers stay superuser-only. • Environment pages: • Read-only admins see nodes, queries and carves read-only. Vulnerabilities, Tags, Enroll and Config need env admin, as the server requires. • Run query needs query tier and New carve needs carve tier. Bulk query/carve actions, node tagging, archiving and deleting need env admin. • Environment Edit and Delete need both environment management and env admin on that environment. • Alerts: • Rule and channel actions follow the server. Log-content rules need full query tier in the rule's environment. • Channels that log-content rules send to are superuser-only. • History is visible to everyone who can see the page. • A new rule defaults to a source the user is allowed to use. • Node alert modal: log-match and error rule kinds follow the same rule as alerts. • Profile: shows a badge for every role held. Health and Alerts show a no-access message instead of an empty page. Users page. • Badges for every global role. • Roles editor (

POST /api/v1/users/{username}/edit

): sends only the roles you changed. Only superusers see the Superuser box, and superuser accounts show no actions to non-superusers. Role checkboxes are also on the create form. • Permissions: • Query and carve tier selects (None / Tags / Standard / Full), with a tag picker for the Tags tier. The picker offers only that environment's non-sensitive tags. • The matching on/off flag is always sent with its tier. • Saving all environments at once offers None / Standard / Full only, never sends tag grants, and is disabled while a Tags tier is chosen. Tags page. A Sensitive badge and checkbox. Turning it on asks for confirmation, because it removes the tag from every grant and cancels pending work that users below full tier can no longer reach. Create, edit and delete need env admin. Environment config. A new Sensitive paths tab lists, adds and removes the environment's sensitive carve paths, and shows the server's validation messages. Security and operational impact • Frontend only, no Go changes. The server stays authoritative: every UI gate mirrors a server rule and none replaces it. • The users page tag picker uses the all-tags list filtered by environment, because the per-environment tags call needs env admin. • New UI text is plain English, with no new translation keys. Known limits • No route-level guards. Pages hide controls and show a no-access message, and the server refuses everything else. • Some page subtitles still read "Super-admin view…", because fixing them needs new translation keys. • The Sensitive paths tab shows only to env admins, because read-only admins can't open the environment config page. • Follow-up: • the nodes page hides Tag…, Archive and Delete from env admins when opened by environment UUID (environment matched by name only); • a users-page label for read-only admins is misleading. Validation • `cd frontend && npm test`: 81 files, 771 tests pass. New and updated tests cover: • the access module; • navigation for every role; • users page payloads: roles as a diff, tier with its on/off flag, scope tags per environment, bulk save without scope tags, sensitive tags excluded; • the alerts rule, channel and history rules; • environment, queries, carves and nodes write gating; • the sensitive tag confirmation flow; • the sensitive paths tab; • the node alert modal rule kinds. •

npm run lint

(tsc) and

npm run build

pass. •

git diff --stat -- cmd pkg

is empty. • Not run: Playwright (the frontend has no Playwright config or e2e tests) and in-browser checks. Screenshots still need to be added. jmpsec/osctrl