You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix: gate Programs dashboard routes on program_management (EN-245) - #1301
Seven admin dashboard routes returned Programs numbers even when program_management was off for the facility: the five /api/department-metrics/programs/* routes, /api/dashboard/class-metrics and /api/dashboard/facility-health. EN-194 removed the feature-aware route helper, so they were registered with no feature.
Ticket: EN-245
Changes
Backend: adds newAdminFeatureRoute in utils.go and registers the 7 routes with models.ProgramAccess. They now answer 401 "Feature not enabled" like other gated routes; the admin check still runs first.
Test:TestProgramsCoreRouteAccess now pins the gate (resident: not admin; admin without the feature: 401; admin with it: allowed). Goldens are unchanged.
Frontend: the Dashboard skips the class-metrics and facility-health requests and hides the metric cards and Facility Health Overview, and Operational Insights hides the Programs tab, when the user lacks program_management.
Not changed
The Dashboard's missing-attendance and todays-schedule widgets. Those routes are served by the Programs module and already carry program_management there (Features: prog), so the server returns 401 with the feature off. The Dashboard still fetches them; skipping those fetches is a separate frontend change.
The gate follows the admin's home facility flag, not the queried facility.
No actionable comments were generated in the recent review.
Summary
Summary by CodeRabbit
Access Controls
Program metrics, class metrics, and facility health endpoints require administrator access with program access enabled.
Dashboard views show a programs-off notice instead of program content when access is unavailable, and skip program-data requests.
The Programs tab and its content in Operational Insights are available only to users with program access.
Access checks distinguish non-admin users from administrators without the required feature access.
Seven backend metrics routes now require ProgramAccess. The dashboard skips program-data requests and displays a notice when access is disabled. Operational insights displays the Programs tab and content only when the signed-in user has access.
Changes: Program feature access
Layer / File(s)
Summary
Require program access on metrics routes backend/src/handlers/utils.go, backend/src/handlers/dashboard.go, backend/tests/integration/programs_core_routes_test.go
A feature-aware admin route helper registers seven metrics routes with ProgramAccess. Integration tests check responses for facility admins with and without the feature.
Gate dashboard metrics and health frontend/src/pages/Dashboard.tsx
The dashboard checks ProgramAccess before requesting class metrics, missing attendance, facility health, and today’s schedule. When access is disabled, dashboard views display a programs-off notice instead of dashboard content.
Gate the Programs insights tab frontend/src/pages/insights/OperationalInsights.tsx
The Programs tab and its content render only when a signed-in user has ProgramAccess.
Merge Risk: Minimal · up to 18180
The change gates the Programs dashboard routes and UI on the program_management feature. No concrete merge-blocking risk was found.
Pre-merge checks: 4
Check name
Status
Explanation
Title check
The title names the main change: gating the Programs dashboard routes on the program_management feature. It also cites the ticket EN-245. The title matches the backend route change and the test update…
Description check
The description states the problem, the seven affected routes, and the fix. It covers the backend helper and route registration, the updated TestProgramsCoreRouteAccess test, and the frontend Dashboar…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names the main change: gating the Programs dashboard routes on the program_management feature. It also cites the ticket EN-245. The title matches the backend route change and the test update described in the summary.
Full details: Description check
Explanation
The description states the problem, the seven affected routes, and the fix. It covers the backend helper and route registration, the updated TestProgramsCoreRouteAccess test, and the frontend Dashboard and Operational Insights gating. It also lists what was not changed. It relates directly to the changeset.
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 2a4714d5-42e3-4363-bdc0-8b76a1da5bbc
Commits
Reviewing files that changed from the base of the PR and between 5f16389 and 18180ce.
Files selected for processing: 1
frontend/src/pages/Dashboard.tsx
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
The Dashboard still shows Programs with the feature off. The ticket asks for the dashboard to hide the Programs cards, but three are left:
Today's Schedule and Missing Attendance still fetch /api/program-classes/todays-schedule and /missing-attendance. With Programs off, both answer 401, so Today's Schedule is empty and Missing Attendance says "All attendance up to date", which isn't true; it just couldn't load. Each 401 also sends an api_error event and a session recheck.
Quick Actions only has "View All Programs" and "Browse Classes". Both pages are behind ProgramAccess, so clicking either one just bounces the admin.
Please gate them the same way you did the others: pass null to useSWR for the two fetches when !programsEnabled, and wrap TodaysSchedule, MissingAttendanceWidget and QuickActions in programsEnabled && in both views. With all of that hidden, the page is only the header, so add a short line under it in that case, for example "Programs isn't turned on for this facility."
What has to happen before EN-245 can close:
This PR is merged. Everything is in core, so nothing else is needed in another repo.
On staging (core goes there on merge): turn off program_management for a facility and sign in as its admin.
The Dashboard shows no Programs cards and makes no Programs calls (check the Network tab).
Insights has no Programs tab.
GET /api/dashboard/class-metrics returns 401 "Feature not enabled".
Then turn the feature back on and check that everything comes back.
…ement is off (EN-245)
Today's Schedule, Missing Attendance and Quick Actions still rendered and fetched with the feature off, so Missing Attendance read "All attendance up to date" after a 401. Skip both fetches and show a one-line notice instead.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
carddev81
left a comment
Seven admin dashboard routes returned Programs numbers even when
program_managementwas off for the facility: the five/api/department-metrics/programs/*routes,/api/dashboard/class-metricsand/api/dashboard/facility-health. EN-194 removed the feature-aware route helper, so they were registered with no feature.Ticket: EN-245
Changes
newAdminFeatureRouteinutils.goand registers the 7 routes withmodels.ProgramAccess. They now answer 401 "Feature not enabled" like other gated routes; the admin check still runs first.TestProgramsCoreRouteAccessnow pins the gate (resident: not admin; admin without the feature: 401; admin with it: allowed). Goldens are unchanged.program_management.Not changed
missing-attendanceandtodays-schedulewidgets. Those routes are served by the Programs module and already carryprogram_managementthere (Features: prog), so the server returns 401 with the feature off. The Dashboard still fetches them; skipping those fetches is a separate frontend change.