Aman-Mittal commented on issue #112:
URL:
https://github.com/apache/fineract-backoffice-ui/issues/112#issuecomment-5306475348
Implemented in #368. All four acceptance criteria are met:
- [x] **Direct navigation to a restricted URL shows the Access Denied
page.** `permissionGuard`
(`core/guards/permission.guard.ts`) returns a `UrlTree` to `/forbidden`,
rendered by
`features/errors/access-denied.component.ts` — both at the paths this
issue specified.
- [x] **Page lists the specific required permission(s).** The guard passes
them along as a
`required` query parameter and the page names them. I initially left this
out, on the reasoning
that a permission code is a hint worth withholding — that was wrong for
this application:
everyone who reaches the page is authenticated back-office staff, and the
codes are the one
piece of information that lets them tell an administrator exactly what to
grant instead of
opening a support conversation.
- [x] **"Go to Dashboard" button provided**, and reachable by keyboard alone
(the heading takes
focus on arrival, so a single Tab reaches it).
- [x] **Refusal is logged.** The guard writes a `console.warn` naming the
refused URL, the
requirement, and the user. Scoped honestly: it is a support trace, not an
audit record — the
browser is not a place anything auditable can live, and Fineract writes
the authoritative entry
when the request it refuses actually arrives.
Beyond the acceptance criteria, the page has a single `<h1>` that takes
focus on activation (a
guard redirect is a navigation the user did not ask for), a polite
`aria-live` announcement, and
i18n keys in en/hi/ko — no hardcoded strings.
Worth noting for anyone reviewing: the guard is a `CanActivateFn` rather
than the `CanMatchFn` the
technical notes suggest. A failing `canMatch` makes the router carry on
looking for a match and
land on `path: '**' → redirectTo: ''`, silently depositing the user on the
dashboard — which is
the "broken/empty screen" outcome this issue exists to prevent, and it
cannot be asserted on.
`canActivate` can return a `UrlTree`, which is what makes the refusal a page.
Covered by `permission.guard.spec.ts`, `access-denied.component.spec.ts`,
and the Access Denied
scenarios in `e2e/rbac-route-protection.spec.ts`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
