Repository navigation
Share a matrix with named colleagues (behind the Matrix sharing feature flag) - #1175
Merged
Merged
Conversation
Contributor
|
🤖 Built + verified on dev-docker-09 (e2e + CI green) → https://9.build.identityatlas.io |
…1166) The DoR adjustment run for #1166 died on an expired app token before it could push its second fix attempt, leaving three Playwright failures on the PR. All three are addressed here, and two of them were real product problems rather than test problems. 1. The share dialog was destroyed whenever the matrix decided a different view should render. MatrixArea picks one of RollupMatrixView / RotatedMatrixView / MatrixView from the data, so a roll-up payload landing mid-session unmounts the whole view — and the dialog lived inside the toolbar inside that view. In CI the e2e clicked "Share view…" during the cold-start load, typed a name, and the dialog vanished under it when the matrix finished loading; the same would happen to an analyst on a slow tenant. The dialog now lives in MatrixArea, above the swap, with the button reduced to asking it to open. It gets its own Suspense boundary so loading the lazy chunk doesn't blank the matrix behind it. 2. Two toolbar buttons were both called "Share…". The pre-existing "Share Link" (copy the current URL, for a colleague who already uses Identity Atlas) sat next to the new "Share view…" (mint a read-only link for someone with no role at all). Renamed the former to "Copy link" and gave it a tooltip that says what it actually does. The e2e's loose /Share/i locator was a symptom, not the bug. 3. The wizard's new optional "Share" step was unknown to the e2e's STEP_MARKERS map, failing four matrix adjust tests. Tests: new MatrixArea.mount.test.jsx pins the dialog (and its half-typed input) surviving the view swap; SharedViewContext gains an assertion that the two sharing controls are named apart; the weak `if count > 0` e2e share-button test is replaced with one that names both buttons. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
… view swap (#1166) The previous commit moved the share dialog up to MatrixArea, which was not far enough. The Playwright trace from that run shows the dialog opening, its lazy chunk loading, and the dialog then disappearing before anything could be typed into it. MatrixArea was the wrong level because AppMain replaces the ENTIRE body with the loading pane whenever useMatrix reports `loading` — which a matrix refetch does routinely. So the dialog now survived the roll-up view swap and still died on the refetch that usually precedes it. AppMain is the shallowest level above both swaps, so the dialog lives there and MatrixArea is back to passing `onShareView` through. Also updated the one adjust test that pins the wizard's step list: 'Share' is a real fifth step for anyone holding `data.share`, which on an auth-off deployment is everyone. The regression test moved with the dialog and now drives both swaps in sequence — refetch, then roll-up payload — asserting the dialog and its half-typed input come through intact. Verified it discriminates: putting the dialog back inside AppMain's body switch fails it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
🤖 Built + verified on dev-docker-07 (e2e + CI green) → https://7.build.identityatlas.io |
The adjustment commit 839594a landed on the branch but GitHub created no workflow run for it, so the build could not be verified. Empty commit to re-request CI on the same tree.
The PR had drifted into a conflicting state against main, which is why CI stopped running on it: GitHub cannot build a merge ref for a conflicting PR, so it creates no pull_request workflow runs at all, and the DoR verify loop timed out waiting for checks that could never appear. Conflicts resolved: - adminTabs / AdminPage / pageRegistry: keep both the Shared Matrices tab and main's Experimental tab; AdminRoute takes main's features/version props. - stryker.pilot.config.json + vitest.stryker.config.js: union of both mutate and test lists; the _comment keeps main's newer measurements and the #1166 pure-logic scope paragraph. - migrations: main and this branch both added a 061. The share migrations are renumbered 062/063 (never deployed anywhere, so renaming is safe) and the hash baseline updated to match. - MatrixFilterWizard.mount.test.jsx: main's business-role test walked to the end and clicked Apply; sharing is now the last step, so it advances one more step first — the same pattern the other tests in this file already use. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…erge exposed The merge of main had to be landed before CI could run on this PR at all, and it surfaced three things: - stryker.pilot.config.json lost main's five crawler `mutationExclusions` when the two sides' disjoint blocks were reconciled, so the mutation-scope guard reported five undecided files. Both sides' exclusions and mutate lists are now unioned. - The share form's copy control was labelled "Copy link", the same accessible name as the matrix toolbar's existing "Copy link" — which copies the current URL rather than a share. With the wizard open both were in the DOM, so the e2e hit a strict-mode violation. MatrixToolbar already documents these two actions as "deliberately named apart"; the form's is now "Copy share link", which is what makes that comment true. - The two sharing e2e tests drove the same ShareMatrixForm through the same twelve lines, which jscpd counted as a new clone. Extracted as fillShareForm(). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Resolve pageRegistry.jsx: keep both the new reports route (#1173) and the legacy shared-matrices Admin route. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
#1166) A share recipient now sees only the matrix: MatrixFilterSummary and MatrixScopePanel render nothing (and fetch nothing) under the shared-view flag. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Resolve matrixWizard.js (keep the openWizard helper, arm main's full-columns wait through a beforeOpen hook) and stryker.pilot.config.json (union of both sides' scope, exclusions and notes). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
… flag (#1166) Off by default. While off, every /api/matrix/shares route (resolve included) answers 404, and the wizard's Share step, the toolbar's Share view… and the Admin → Shared Matrices tab are hidden. Toggle under Admin → Experimental, or FEATURE_MATRIX_SHARING=true. Existing shares are kept. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
WimvandenHeijkant
changed the title
WimvandenHeijkant
marked this pull request as ready for review
September 13, 2026 12:13
WimvandenHeijkant
requested review from
TaekeK and
WimvandenHeijkant
as code owners
September 13, 2026 12:13
WimvandenHeijkant
approved these changes
Sep 13, 2026
The flag-off case duplicated the no-permission case line for line, which the jscpd gate counted as a new clone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
|
♻️ PR merged. Reset dev-docker-09 (stack down, volumes + images pruned) and released it back to the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1166
Share a configured matrix with named colleagues who have no Identity Atlas role, such as a team manager or an application owner. The whole feature ships behind the experimental
matrixSharingfeature flag, switched off by default.Functional-test env: https://9.build.identityatlas.io. The requestor has tested it there.
What it does
#shared-matriceslinks still land on this tab.data.share("Create matrix share links"), granted to RoleMiner by default.Feature flag
FEATURE_MATRIX_SHARING=true./api/matrix/sharesroute answers404before any permission check or database read. That includes resolve, so links that were already sent stop opening.docker-compose.ci.ymlstarts with the flag on so the sharing e2e keeps running. The off behaviour is covered by unit tests.Schema
062_matrix_shares.sqland063_matrix_share_recipients.sqladdMatrixShares,MatrixShareRecipientsandMatrixShareAccesses. The tables are created whether or not the flag is on.Known residual (by design, per the issue)
A recipient is a signed-in reader. The bare view simplifies the UI but is not a data boundary: a technically capable recipient could call other read endpoints. Tightening that is tracked under #1105 and #931. The docs say so.
Tests
requireFeatureare tested, and every share route is checked with the flag off. The UI tests mount each sharing surface with the flag both on and off.🤖 Generated with Claude Code