fix: [UIE-9435] - IAM - Ensure useEntitiesPermissions does not run for admin users

[abailly-akamai]

Description 📝

In useQueryWithPermissions the following util checks permissions for every entity returned by the query:

const useEntitiesPermissions = <T extends EntityBase>(
  entities: T[] | undefined,
  entityType: EntityType,
  profile?: Profile,
  enabled = true
) => {
  const queries = useQueries({
    queries: (entities || []).map((entity: T) => ({
      queryKey: [entityType, entity.id],
      queryFn: () =>
        getUserEntityPermissions(
          profile?.username || '',
          entityType,
          entity.id
        ),
      enabled,
    })),
  });
  // ...
};

This creates N parallel API requests where N = number of entities. For 3,000 linodes, that's 3,000 requests to:
GET /v4beta/iam/users/{username}/permissions/{entityType}/{entityId}

This is catastrophic for performance, but necessary for restricted users as we have no other way to check permission for a specific entity.

However, this should never run for admin users (`!profile.restricted) as they already have access to those entities.

As a result, I had to improve some loading states where useQueryWithPermissions

Changes 🔄

• Ensure useEntitiesPermissions does not run for admin users
• Improve loading states for a variety of features using useEntitiesPermissions
• Add comments for future refactoring

Scope 🚢

Upon production release, changes in this PR will be visible to:

• All customers
• Some customers (e.g. in Beta or Limited Availability)
• No customers / Not applicable

Preview 📷

Before	After

How to test 🧪

Prerequisites

Use an IAM account with a large amount of Linodes and Firewalls (staging, ask @kwojtowiakamai for access) for large data sets or DevCloud IAM account to confirm the behavior on a small data set.

👉 As an ADMIN:

🐛 Bug

• Navigate to /firewalls/create
  • 🚫 notice the thousands of requests made to the permission endpoint

✅ Fix + improved loading states (now that we don't have to wait for large query sets)

• Navigate to /firewalls/create
  • ✅ no more unnecessary requests
  • ✅ confirm filtering/mapping still works as expected

👉 As a RESTRICTED USER (still seeing permission requests for every entity)

✅ No regression

• Navigate to other areas where useQueryWithPermissions is being used and verify no regressions
  • VPCs (Route: /vpcs/:id)
  • Firewalls (Routes: /firewalls, /firewalls/:id)
  • Volumes (Route: Various - volume attachment)
  • NodeBalancers (Route: Various - nodebalancer selection)
  • Linodes - Backups (Route: /linodes/:id/backup)
  • Images (Route: /images)

Author Checklists

As an Author, to speed up the review process, I considered 🤔

👀 Doing a self review
❔ Our contribution guidelines
🤏 Splitting feature into small PRs
➕ Adding a changeset
🧪 Providing/improving test coverage
🔐 Removing all sensitive information from the code and PR description
🚩 Using a feature flag to protect the release
👣 Providing comprehensive reproduction steps
📑 Providing or updating our documentation
🕛 Scheduling a pair reviewing session
📱 Providing mobile support
♿ Providing accessibility support

• I have read and considered all applicable items listed above.

As an Author, before moving this PR from Draft to Open, I confirmed ✅

• All tests and CI checks are passing
• TypeScript compilation succeeded without errors
• Code passes all linting rules

[abailly-akamai]

This is the actual fix

[aaleksee-akamai]

Cool, thanks a lot! Confirm there is no fetching per entity for account_admin user.

Also you might want to add the loading state to SubnetAssignLinodesDrawer as well since you've done it to to other components

[mpolotsk-akamai]

Looks great, thanks for the fix!

[linode-gh-bot]

Cloud Manager UI test results

🔺 1 failing test on test run #11 ↗︎

❌ Failing	✅ Passing	↪️ Skipped	🕐 Duration
1 Failing	852 Passing	11 Skipped	41m 44s

Details

Failing Tests
	Spec	Test
❌	clone-linode.spec.ts	Cloud Manager Cypress Tests→clone linode » can clone a Linode from Linode details page

Troubleshooting

Use this command to re-run the failing tests:

pnpm cy:run -s "cypress/e2e/core/linodes/clone-linode.spec.ts"

[dwiley-akamai]

Code review ✅
Verification steps ✅