[PR] fix(rbac): per-kind template-save permission, surface infra-3d:read, plus docs + UI fixes [skywalking-horizon-ui]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng opened a new pull request, #60:
URL: https://github.com/apache/skywalking-horizon-ui/pull/60

   ## Why
   
   A pass over RBAC permission correctness, public docs accuracy, and a few UI bugs found while testing against a live OAP.
   
   - `infra-3d:read` was enforced on the 3D-map routes and granted to every built-in role, but was missing from the verb catalog — so it never showed on the **Roles & Permissions** board or **Auth Status**, and an admin couldn't see who could view the 3D map.
   - The layer-dashboard editor advertises `dashboard:write`, but the actual save (`/api/admin/templates/save`) was enforced wholesale on `overview:write`, so a custom role granted only `dashboard:write` could open the editor and then 403 on save.
   - Several `docs/` pages had drifted from the shipping UI (a removed cluster-member feature, an auth-gated readiness probe, removed template config shapes, a reversed component default).
   - Three UI bugs: the Metrics Inspect crosshair tooltip was clipped behind the sidebar; on the 3D-map config page "Check diff & push" was selectable before saving a local draft and its diff dialog rendered empty.
   
   ## What
   
   **RBAC**
   - Add `infra-3d:read` to the verb catalog (+ Roles board label / group / menu-visibility row). Grants are unchanged.
   - Enforce `/api/admin/templates/save` **per kind**: `layer` → `dashboard:write`, other kinds → `overview:write`, checked in the handler before any OAP write. Built-in roles unaffected (operator/admin hold both).
   - Regroup `ROUTE_POLICY` by the lowest built-in role that reaches each route and trim comments. **Behavior-neutral** — verified the 128 route→verb pairs are byte-identical before/after.
   
   **UI fixes**
   - Metrics Inspect tooltip → `appendToBody` so it isn't clipped by the widget overflow / sidebar.
   - 3D-map config → gate "Check diff & push" on a saved, non-dirty local draft; give the push diff a definite height (`fit-body` modal + flex wrapper) so the side-by-side comparison renders.
   
   **Docs** — operator-perspective accuracy sweep across ~19 pages (Cluster Status three panes / no member list, readiness probe → `/api/health`, layer-template `components` default + `aliases` key, removed `visibleWhen`/embedded-i18n shapes, data-retention cold stage, RBAC wording).
   
   **i18n** — two new UI strings added to all 8 locales. **CHANGELOG** updated under 0.7.0.
   
   ## Validation
   
   - `pnpm -r type-check`, `build` (UI + BFF), `pnpm license:check` (0 invalid), `pnpm -r lint`, `pnpm -r test:unit` (UI 116 + BFF 116), and BFF `i18n:validate` (no findings) — all green. UI i18n completeness checked across all 8 catalogs.
   - **Live-OAP validated against the public demo:** booted the BFF/UI from source and exercised the per-kind save gate with narrow custom roles — a `dashboard:write`-only role saves layer templates (passes the gate) but 403s on overview saves; an `overview:write`-only role is the mirror; viewer 403s on both; `infra-3d:read` appears in the verb catalog and viewers retain read access to the 3D map. The three UI fixes were confirmed in the running app.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(rbac): per-kind template-save permission, surface infra-3d:read, plus docs + UI fixes [skywalking-horizon-ui]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng merged PR #60:
URL: https://github.com/apache/skywalking-horizon-ui/pull/60


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org