fix: [UIE-9477] - IAM: disable delete and detach popups for Volumes when user has no permissions by mpolotsk-akamai · Pull Request #13049 · linode/manager

mpolotsk-akamai · 2025-11-03T16:06:23Z

Description 📝

This PR fixes an issue where users with the volume_viewer role could manually access Delete and Detach popups via direct URLs, allowing unauthorized requests.

Changes 🔄

List any change(s) relevant to the reviewer.

Added permission checks to disable Delete and Detach popups

Scope 🚢

Upon production release, changes in this PR will be visible to:

All customers
Some customers (e.g. in Beta or Limited Availability)
No customers / Not applicable

Target release date 🗓️

November 18th

Preview 📷

Before	After
📷	📷

How to test 🧪

Prerequisites

(How to setup test environment)

use iam account with volume_viewer role

Verification steps

(How to verify changes)

navigate to the following routes manually:

- http://localhost:3000/volumes/[id]/summary/delete
- http://localhost:3000/volumes/[id]/delete
- http://localhost:3000/volumes/[id]/summary/detach
- http://localhost:3000/volumes/[id]/detach

verify that Delete and Detach actions are disabled when the user does not have the required permissions

Author Checklists

As an Author, to speed up the review process, I considered 🤔

👀 Doing a self review
❔ Our contribution guidelines
🤏 Splitting feature into small PRs
➕ Adding a changeset
🧪 Providing/improving test coverage
🔐 Removing all sensitive information from the code and PR description
🚩 Using a feature flag to protect the release
👣 Providing comprehensive reproduction steps
📑 Providing or updating our documentation
🕛 Scheduling a pair reviewing session
📱 Providing mobile support
♿ Providing accessibility support

I have read and considered all applicable items listed above.

As an Author, before moving this PR from Draft to Open, I confirmed ✅

All tests and CI checks are passing
TypeScript compilation succeeded without errors
Code passes all linting rules

aaleksee-akamai

looks good!

…f no permissions

… popups without permissions

linode-gh-bot · 2025-11-04T12:10:27Z

Cloud Manager UI test results

🔺 2 failing tests on test run #3 ↗︎

❌ Failing	✅ Passing	↪️ Skipped	🕐 Duration
`2 Failing`	`851 Passing`	`11 Skipped`	`48m 29s`

Details

Failing Tests
	Spec	Test
❌	`update-stackscripts.spec.ts`	Cloud Manager Cypress Tests→Update stackscripts » updates a StackScript
❌	`create-stackscripts.spec.ts`	Cloud Manager Cypress Tests→Create stackscripts » creates a StackScript and deploys a Linode with it

Troubleshooting

Use this command to re-run the failing tests:

pnpm cy:run -s "cypress/e2e/core/stackscripts/update-stackscripts.spec.ts,cypress/e2e/core/stackscripts/create-stackscripts.spec.ts"

…hen user has no permissions (linode#13049) * fix: [UIE-9477] - IAM: Disable delete and detach popups for Volumes if no permissions * Added changeset: IAM: restricted users could access delete and detach popups without permissions

* initial commit * Added changeset: Address oAuth issue with IAM OAuthCallback * fix: [UIE-9456 & UIE-9457] - Typo + expose search filters on /iam/roles route (#13034) * UIE-9456 & UIE-9457 * test * Added changeset: Typo + expose search filters on /iam/roles route * feat: [UIE-9481] - IAM: add perm check for the drawer (#13043) * feat: [UIE-9481] - IAM: add perm check for the drawer * Added changeset: IAM: add a permission check for delete nodebalancer drawer * feat: [UIE-9503] - add empty state to Default Roles/Entities tab (#13042) * feat: add empty state to Default Roles/Entities table * Added changeset: IAM: Empty state for the Default Roles and Default Entities Access tabs * update text * add unit tests * review fix * unit test fix * fix: [UIE-9478] - IAM: disable tag edit (#13046) * fix: [UIE-9478] - IAM: disable tag edit * Added changeset: IAM: tags editing was enabled for restricted users * fix: [UIE-9478] - add tooltip, disable manage tags in Volume action menu * style fix * Cloud version 1.154.0, API v4 version 0.152.0, Validation version 0.78.0, UI version 0.23.0 * Cloud version 1.154.0, API v4 version 0.152.0, Validation version 0.78.0, UI version 0.23.0 * fix: [M3-10698] - Update linode/clone endpoint and label calculations for < 1 hour (#13045) * fix: [M3-9498] - Update linode/clone endpoint and label calculations for < 1 hour * Add changelogs --------- Co-authored-by: Jaalah Ramos <jaalah.ramos@gmail.com> * fix: [UIE-9520] - IAM Child Account - user not found error handling (#13047) * try/cath child user query * consistent handling * types * Added changeset: IAM Child Account - user not found error handling * fix: [UIE-9477] - IAM: disable delete and detach popups for Volumes when user has no permissions (#13049) * fix: [UIE-9477] - IAM: Disable delete and detach popups for Volumes if no permissions * Added changeset: IAM: restricted users could access delete and detach popups without permissions * upcoming: [UIE-9434] - Create feature flag for generational compute plans (#13054) * upcoming: [UIE-9434] - Create feature flag for generational compute plans * Added changeset: Feature flag for Generational Compute plans * test: [DPS-34825] Add cypress tests for Create/Edit Stream forms and Streams Landing (#13008) * refactor: [DI-27807] - Change status of edit & delete button in alert list table based on status (#13052) * refactor: [DI-27807] - Change status of edit & delete button in alert list table based on status * Added comment * Added changeset * refactor: [DI-27807] - Updated test cases * upcoming: [UIE-9368] - Create a firewall Rulesets & Preflixlists feature flag (#13051) * Add firewall rs & pl feature flag * Added changeset: Feature flag for Firewall Rulesets & Prefixlists * feat: [UIE-9341, UIE-9342, UIE-9521] - IAM: fix perm for vpcs (#13050) * UIE-9342 * UIE-9341 * feat: [UIE-9341, UIE-9342, UIE-9521] - IAM: fix perm for vpc * Added changeset: IAM: fix permissiom's check for vpc for assigning/unassigning linodes * filter linodes * e2e deferred getLinodes call --------- Co-authored-by: Alban Bailly <abailly@akamai.com> * refactor: [UIE-9325] - Replace Formik with React Hook Form in AddAccessControlDrawer (#13044) ## Description 📝 Refactor Database Manage Networking drawer to use React Hook Form instead of Formik ## Changes 🔄 - There should be no visual external changes other than IP validation on blur instead of after clicking Update Access Controls ## How to test 🧪 ### Prerequisites (How to setup test environment) - Have the Database VPC feature flag enabled ### Verification steps (How to verify changes) - [ ] Test adding/editing IPs in the Database landing page via Manage Access Controls action dropdown - [ ] Test adding/editing IPs in the Database details page via the Networking tab - [ ] There should be no regressions compared to prod, error messages should display * [UIE-9533] -Hopeful fix: Race condition with Preferences overrides in PrimaryNav (#13056) * attempt to rule out any race condition * comments * code and fixes * cleanup * Added changeset: Race condition with Preferences overrides in PrimaryNav * feat: [UIE-9393] - IAM Parent/Child: delegate permissions for child account (#13033) * feat: [UIE-9393] - IAM Parent/Child: delegate permissions for child account * changesets * remove the unrestricted check for query * fix conflict * e2e gating * lint fix * better approach to fixing e2e * Mock IAM to be disabled in Account Switching test --------- Co-authored-by: Alban Bailly <abailly@akamai.com> Co-authored-by: Alban Bailly <130582365+abailly-akamai@users.noreply.github.com> Co-authored-by: Joe D'Amore <jdamore@akamai.com> * feat: [UIE-9534] - IAM: fix perm for nodebalancer (#13058) * feat: [UIE-9534] - IAM: add tooltips * Added changeset: IAM: add tooltips for disabled buttons for nodebalancers, remove notification banner * update text * remove tooltip * change:[UIE-9541] Add MSW crud support for types API (#13067) * change:[UIE-9541] Add MSW crud support for types API * Added changeset: Add MSW crud support for types API * Added changeset: Add MSW crud support for types API --------- Co-authored-by: aaleksee-akamai <aaleksee@akamai.com> Co-authored-by: mpolotsk-akamai <157619599+mpolotsk-akamai@users.noreply.github.com> Co-authored-by: Dajahi Wiley <dwiley@linode.com> Co-authored-by: Jaalah Ramos <125309814+jaalah-akamai@users.noreply.github.com> Co-authored-by: Jaalah Ramos <jaalah.ramos@gmail.com> Co-authored-by: grevanak-akamai <145482092+grevanak-akamai@users.noreply.github.com> Co-authored-by: mduda-akamai <mduda@akamai.com> Co-authored-by: Nikhil Agrawal <165884194+nikhagra-akamai@users.noreply.github.com> Co-authored-by: Purvesh Makode <pmakode@akamai.com> Co-authored-by: Hana Xu <115299789+hana-akamai@users.noreply.github.com> Co-authored-by: Joe D'Amore <jdamore@akamai.com>

github-project-automation bot added this to Cloud Manager Nov 3, 2025

github-project-automation bot moved this to Review in Cloud Manager Nov 3, 2025

mpolotsk-akamai self-assigned this Nov 3, 2025

mpolotsk-akamai added the IAM (Identity & Access Management) label Nov 3, 2025

mpolotsk-akamai requested a review from kwojtowiakamai November 3, 2025 16:06

mpolotsk-akamai marked this pull request as ready for review November 4, 2025 09:59

mpolotsk-akamai requested a review from a team as a code owner November 4, 2025 09:59

mpolotsk-akamai requested review from aaleksee-akamai and abailly-akamai November 4, 2025 09:59

mpolotsk-akamai added the Volumes Relating to Volumes (aka Block Storage) label Nov 4, 2025

aaleksee-akamai approved these changes Nov 4, 2025

View reviewed changes

mpolotsk-akamai added 2 commits November 4, 2025 12:14

fix: [UIE-9477] - IAM: Disable delete and detach popups for Volumes i…

79c20db

…f no permissions

Added changeset: IAM: restricted users could access delete and detach…

54146d9

… popups without permissions

mpolotsk-akamai force-pushed the UIE-9477-volumes-perm-fix branch from 1c524fc to 54146d9 Compare November 4, 2025 11:14

abailly-akamai approved these changes Nov 5, 2025

View reviewed changes

github-project-automation bot moved this from Review to Approved in Cloud Manager Nov 5, 2025

mpolotsk-akamai merged commit 2a4799b into linode:develop Nov 5, 2025
34 of 35 checks passed

github-project-automation bot moved this from Approved to Merged in Cloud Manager Nov 5, 2025

This was referenced Nov 13, 2025

Release v1.155.0 - release → staging #13085

Merged

Release v1.155.0 - staging → master #13101

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: [UIE-9477] - IAM: disable delete and detach popups for Volumes when user has no permissions#13049

fix: [UIE-9477] - IAM: disable delete and detach popups for Volumes when user has no permissions#13049
mpolotsk-akamai merged 2 commits intolinode:developfrom
mpolotsk-akamai:UIE-9477-volumes-perm-fix

mpolotsk-akamai commented Nov 3, 2025 •

edited

Loading

Uh oh!

aaleksee-akamai left a comment

Uh oh!

linode-gh-bot commented Nov 4, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

mpolotsk-akamai commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description 📝

Changes 🔄

Scope 🚢

Target release date 🗓️

Preview 📷

How to test 🧪

Prerequisites

Verification steps

As an Author, to speed up the review process, I considered 🤔

As an Author, before moving this PR from Draft to Open, I confirmed ✅

Uh oh!

aaleksee-akamai left a comment

Choose a reason for hiding this comment

Uh oh!

linode-gh-bot commented Nov 4, 2025

Cloud Manager UI test results

🔺 2 failing tests on test run #3 ↗︎

Details

Troubleshooting

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mpolotsk-akamai commented Nov 3, 2025 •

edited

Loading