fix(client): stop gating project creation on the flat admin-only flag - #3493
Open
Kaveh-Vakili wants to merge 5 commits into
Open
fix(client): stop gating project creation on the flat admin-only flag#3493Kaveh-Vakili wants to merge 5 commits into
Kaveh-Vakili wants to merge 5 commits into
Conversation
configStore.isEngineOperationAvailable("PROJECT", "add") only checks a
single boolean (adminOnlyProjectAdd) with no awareness of project type,
but the backend now allows specific types through even when that flag
is enabled. Three places were still using this flat check to pre-emptively
block or hide creation entirely, making Agent/Skill/Blocks creation
impossible for non-admins even when the backend correctly allows them:
- project-catalog.tsx: "Add App/Skill/Agent" button was hidden entirely
whenever adminOnlyProjectAdd was true, regardless of type.
- create-app-page.tsx: redirected away from /app/new entirely for the
same reason, blocking both Code and Blocks creation.
- landing-page.tsx: redirected the whole home page to itself, rendering
nothing, for any non-admin whenever adminOnlyProjectAdd was true.
Removed all three gates. The backend is the source of truth for this
restriction and already enforces it correctly per project type; the UI
no longer needs to (and can't correctly, without also knowing the
exempt-types list) pre-emptively guess at it.
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Contributor
Author
|
Open question for reviewers The button in project-catalog.tsx is currently shown to all users regardless of adminOnlyProjectAdd. Options for how to handle this: Hide entirely — isEngineOperationAvailable(...) ? : null |
Kaveh-Vakili
marked this pull request as ready for review
July 30, 2026 21:02
The previous commit removed the Add button gate entirely across Project/Skill/Agent catalogs, since the old flat adminOnlyProjectAdd check couldn't distinguish between them. The backend has since added independent flags (adminOnlyWorkspaceAdd, adminOnlySkillAdd) alongside the existing adminOnlyProjectAdd, so each catalog can now check the flag that actually applies to it instead of showing every button unconditionally. - types.d.ts: ALL_TYPES now includes WORKSPACE and SKILL. - config.store.ts: moduleMap maps WORKSPACE -> adminOnlyWorkspaceAdd and SKILL -> adminOnlySkillAdd. - project-catalog.tsx: new CATALOG_PERMISSION_TYPE map translates each catalog's UI type (CODE/SKILL/WORKSPACE) to the permission type that actually gates it - CODE still checks PROJECT (Code/Blocks stay bundled under that flag), while SKILL/WORKSPACE check their own independent flags. The Add button now shows/hides per catalog based on its own flag rather than unconditionally.
… catalog- landing-page.tsx: resolve merge conflict; remove flat isRestricted gate so the Get Started section shows for all users (backend enforces per-type)- project-catalog.tsx: fix filterBox to use CATALOG_PERMISSION_TYPE[type] instead of hardcoded PROJECT, matching the headerActions check above it- config.store.ts: add adminOnlyWorkspace* and adminOnlySkill* type declarations and false defaults to match backend PR #2807 fields
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
configStore.isEngineOperationAvailable("PROJECT", "add") only checks a single boolean (adminOnlyProjectAdd) with no awareness of project type. The backend was recently updated ([companion PR in Semoss]) to allow specific project types through even when that flag is enabled, but three places in the UI were still using this flat, non-type-aware check to pre-emptively block or hide creation entirely — making it impossible for non-admins to create Agent/Skill/Blocks apps even when the backend correctly allows them. This PR removes those incorrect gates so the UI stops guessing and lets the backend be the actual source of truth.
Changes Made
project-catalog.tsx — the "Add App/Skill/Agent" button was hidden entirely whenever adminOnlyProjectAdd was true, regardless of type. Now always shown.
create-app-page.tsx — redirected away from /app/new entirely for the same reason, blocking both Code and Blocks creation. Redirect removed.
landing-page.tsx — redirected the whole home page to itself, rendering nothing, for any non-admin whenever adminOnlyProjectAdd was true. Redirect removed.
How to Test
Set ADMIN_ONLY_PROJECT_ADD=true on the backend (with ADMIN_ONLY_PROJECT_ADD_EXEMPT_TYPES including WORKSPACE,SKILL,BLOCKS), log in as a non-admin user.
Confirm "Add Agent"/"Add Skill"/"Add App" buttons are visible, and creating an Agent, Skill, or Blocks app succeeds.
Confirm attempting to create a CODE app still correctly fails with the backend's "limited to only admins" error — this UI change doesn't bypass the actual restriction, it just stops incorrectly hiding options the backend would allow.
Notes
Companion to the Semoss PR adding ADMIN_ONLY_PROJECT_ADD_EXEMPT_TYPES.
Depends on that backend PR to be meaningful — without it, adminOnlyProjectAdd=true still blocks everything at the backend level regardless of these UI fixes.