fix(site): backport admin settings dropdown visibility fix to release/2.34 (#27851)

matifali · jeremyruppel · web-flow · commit 350070e97dbc · 2026-08-06T02:01:48.000+05:00
Backport of #27481 to `release/2.34`. ## Problem `canViewAnyOrganization` included `viewAnyMembers`, a permission every user now has because of workspace sharing. This meant the Admin settings dropdown (and the Organizations entry within it) showed up for every user, not just admins. ## Fix - Removed `permissions.viewAnyMembers` from `canViewAnyOrganization` in `site/src/modules/permissions/index.ts`. - Updated `site/e2e/tests/roles.spec.ts` to match, including a new regression test for org members with no roles. ## Note on scope Upstream #27481 also refactored `DeploymentDropdown`/`MobileMenu` into a shared `AdminSettings.tsx` component driven by a single permissions object. That refactor doesn't apply to `release/2.34`: this branch's `DeploymentDropdown` and `MobileMenu` already gate the Admin settings menu with equivalent per-permission checks, so only the actual permission fix and its test coverage are backported here. ## Validation - `pnpm exec biome check` on the two changed files: clean. - Confirmed pre-existing `tsc` errors in this branch are unrelated environment/dependency issues (reproduced identically on a clean `release/2.34` checkout). > 🤖 This PR was created with the help of Coder Agents, and needs a human review. 🧑💻 --------- Co-authored-by: Jeremy Ruppel <jeremy.ruppel@gmail.com>
diff --git a/site/e2e/tests/roles.spec.ts b/site/e2e/tests/roles.spec.ts
@@ -61,25 +61,21 @@ test.describe("roles admin settings access", () => {
 		await login(page, users.templateAdmin);
 		await page.goto("/", { waitUntil: "domcontentloaded" });
 
-		await hasAccessToAdminSettings(page, ["Deployment", "Organizations"]);
+		await hasAccessToAdminSettings(page, ["Deployment"]);
 	});
 
 	test("user admin can see admin settings", async ({ page }) => {
 		await login(page, users.userAdmin);
 		await page.goto("/", { waitUntil: "domcontentloaded" });
 
-		await hasAccessToAdminSettings(page, ["Deployment", "Organizations"]);
+		await hasAccessToAdminSettings(page, ["Deployment"]);
 	});
 
 	test("auditor can see admin settings", async ({ page }) => {
 		await login(page, users.auditor);
 		await page.goto("/", { waitUntil: "domcontentloaded" });
 
-		await hasAccessToAdminSettings(page, [
-			"Deployment",
-			"Organizations",
-			"Audit Logs",
-		]);
+		await hasAccessToAdminSettings(page, ["Deployment", "Audit Logs"]);
 	});
 
 	test("owner can see admin settings", async ({ page }) => {
@@ -88,7 +84,6 @@ test.describe("roles admin settings access", () => {
 
 		await hasAccessToAdminSettings(page, [
 			"Deployment",
-			"Organizations",
 			"Healthcheck",
 			"Audit Logs",
 		]);
@@ -103,6 +98,23 @@ test.describe("org-scoped roles admin settings access", () => {
 		await setupApiCalls(page);
 	});
 
+	test("member cannot see admin settings", async ({ page }) => {
+		// The unlicensed member test above cannot catch all regressions here.
+		// Many admin settings are locked behind a license and wouldn't be shown.
+		const org = await createOrganization();
+		const member = await createOrganizationMember({
+			orgRoles: {
+				[org.id]: [],
+			},
+		});
+
+		await login(page, member);
+		await page.goto("/", { waitUntil: "domcontentloaded" });
+
+		// None, "Admin settings" button should not be visible
+		await hasAccessToAdminSettings(page, []);
+	});
+
 	test("org template admin can see admin settings", async ({ page }) => {
 		const org = await createOrganization();
 		const orgTemplateAdmin = await createOrganizationMember({
diff --git a/site/src/modules/dashboard/Navbar/DeploymentDropdown.tsx b/site/src/modules/dashboard/Navbar/DeploymentDropdown.tsx
@@ -67,6 +67,7 @@ export const DeploymentDropdown: FC<DeploymentDropdownProps> = ({
 
 const DeploymentDropdownContent: FC<DeploymentDropdownProps> = ({
 	canViewDeployment,
+	canViewOrganizations,
 	canViewAuditLog,
 	canViewConnectionLog,
 	canViewAIBridge,
@@ -80,9 +81,11 @@ const DeploymentDropdownContent: FC<DeploymentDropdownProps> = ({
 					<Link to="/deployment">Deployment</Link>
 				</DropdownMenuItem>
 			)}
-			<DropdownMenuItem asChild>
-				<Link to="/organizations">Organizations</Link>
-			</DropdownMenuItem>
+			{canViewOrganizations && (
+				<DropdownMenuItem asChild>
+					<Link to="/organizations">Organizations</Link>
+				</DropdownMenuItem>
+			)}
 			{canViewAISettings && (
 				<DropdownMenuItem asChild>
 					<Link to="/ai/settings">AI</Link>
diff --git a/site/src/modules/dashboard/Navbar/MobileMenu.tsx b/site/src/modules/dashboard/Navbar/MobileMenu.tsx
@@ -208,6 +208,7 @@ const ProxySettingsSub: FC<ProxySettingsSubProps> = ({ proxyContextValue }) => {
 
 const AdminSettingsSub: FC<MobileMenuPermissions> = ({
 	canViewDeployment,
+	canViewOrganizations,
 	canViewAuditLog,
 	canViewConnectionLog,
 	canViewHealth,
@@ -239,12 +240,14 @@ const AdminSettingsSub: FC<MobileMenuPermissions> = ({
 						<Link to="/deployment">Deployment</Link>
 					</DropdownMenuItem>
 				)}
-				<DropdownMenuItem
-					asChild
-					className={cn(itemStyles.default, itemStyles.sub)}
-				>
-					<Link to="/organizations">Organizations</Link>
-				</DropdownMenuItem>
+				{canViewOrganizations && (
+					<DropdownMenuItem
+						asChild
+						className={cn(itemStyles.default, itemStyles.sub)}
+					>
+						<Link to="/organizations">Organizations</Link>
+					</DropdownMenuItem>
+				)}
 				{canViewAuditLog && (
 					<DropdownMenuItem
 						asChild
diff --git a/site/src/modules/permissions/index.ts b/site/src/modules/permissions/index.ts
@@ -39,8 +39,7 @@ export const canViewAnyOrganization = (
 ): permissions is Permissions => {
 	return (
 		permissions !== undefined &&
-		(permissions.viewAnyMembers ||
-			permissions.editAnyGroups ||
+		(permissions.editAnyGroups ||
 			permissions.assignAnyRoles ||
 			permissions.viewAnyIdpSyncSettings ||
 			permissions.editAnySettings)
