Skip to content

[RBAC] Deny access to user with no permissions #2946#4560

Open
Yaksha-sn wants to merge 1 commit intoprovectus:masterfrom
Yaksha-sn:issues/2946
Open

[RBAC] Deny access to user with no permissions #2946#4560
Yaksha-sn wants to merge 1 commit intoprovectus:masterfrom
Yaksha-sn:issues/2946

Conversation

@Yaksha-sn
Copy link
Copy Markdown

@Yaksha-sn Yaksha-sn commented Mar 19, 2026

When RBAC is enabled and a user has no permissions assigned,
they are now redirected to the 403 Access Denied page instead
of seeing a blank dashboard.

Fixes #2946

  • Breaking change? (if so, please describe the impact and migration path for existing application instances)

What changes did you make?

Added a hasNoPermissions computed value in PageContainer.tsx
that checks if RBAC is enabled and the authenticated user has zero
permissions. If true, the user is redirected to the existing /403
Access Denied page instead of seeing a blank dashboard.

Is there anything you'd like reviewers to focus on?

Whether the redirect logic placement in PageContainer is appropriate,
and if the existing 403 page message "Access is Denied" is sufficient
or should be more specific like "No permissions assigned to your
account. Contact your administrator."

How Has This Been Tested?

  • No need to
  • Manually (please, describe, if necessary)
  • Unit checks
  • Integration checks
  • Covered by existing automation

Mocked useGetUserInfo to return rbacEnabled: true with an empty
permissions array and confirmed redirect to /403 page. Reverted
mock and confirmed normal flow is unaffected.

Checklist

  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (e.g. ENVIRONMENT VARIABLES)
  • My changes generate no new warnings (e.g. Sonar is happy)
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged

cute animal

When RBAC is enabled and a user has no permissions assigned,
they are now redirected to the 403 Access Denied page instead
of seeing a blank dashboard.

Fixes provectus#2946
@Yaksha-sn Yaksha-sn requested a review from a team as a code owner March 19, 2026 14:14
Copy link
Copy Markdown

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello there Yaksha-sn! 👋

Thank you and congrats 🎉 for opening your first PR on this project! ✨ 💖

We will try to review it soon!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[RBAC] Deny access to user with no permissions

1 participant