feat(web): two-tab Read/Write permissions editor (#1125)#1126
Merged
chronoai-shining merged 5 commits intoJun 16, 2026
Conversation
Add the reusable building blocks that separate read and write access: - `PrincipalSelector` — org checkboxes (incl. unresolved-grant handling) + user email typeahead chips for one audience, emitting a flat Principal[]. Consolidates the org/user picking logic previously duplicated in the skill and skillset modals. - `PermissionsEditor` — a Read tab (Public toggle, or restricted orgs/users) and a Write tab (orgs/users who can edit; no public option). Save composes the canonical `grants` (read-tab → read, write-tab → read_write, write wins on overlap; read grants dropped when public since everyone reads) and carries `isPrivate` from the Read tab — so "public read + org/user write" is finally expressible. - `initialGrants` helper — seed the editor from a skill/skillset detail (canonical grants, or read-level derived from legacy lists) + a reset-key signature. Standalone (wired into the modals next). Part of #1125
Replace the single-visibility-ladder PermissionsModal (and the #1123 inline per-grant level toggles) with a thin wrapper around the shared `PermissionsEditor`. An owner can now set independent read/write audiences — notably public read + org/user write, which the old modal couldn't express because turning on Public disabled the grant pickers. Tests rewritten for the new UI: public-read + org-write round-trip, Write tab seeded from an existing read_write grant, and the no-change short-circuit. Part of #1125
Rewire SkillsetPermissionsModal to the shared `PermissionsEditor`, keeping
it in lock-step with the skill modal and removing the near-duplicate
single-ladder implementation. This also brings skillsets the read /
read-write level support they never had. Test updated to the new
`{ isPrivate, grants }` payload; the skills-hook-isolation guard stays.
Part of #1125
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Redesigns Manage Permissions into a two-tab editor that cleanly separates read and write access, so an owner can set combinations the old single-visibility-ladder couldn't reach — notably public read + organization/user write.
Closes #1125
What changed (frontend only)
grants: read-tab →read, write-tab →read_write(write wins on overlap; read grants dropped when public), withisPrivatefrom the Read tab.PrincipalSelector+PermissionsEditorused by both the skill and skillset modals (removed the near-duplicate). Skillsets gain the read/read-write level support they lacked.Not changed
grantsmodel +canReadSkill/canWriteSkillalready supported every combination (public + write grants included). Verified no code path clears grants when public.Verification
typecheck:webclean; full web vitest suite 564 pass; lint 0 errors.{ isPrivate:false, grants:[{org, read_write}] }; Write tab seeded from an existing read_write grant; no-change short-circuit; skillset hook-isolation guard retained.🤖 Generated with Claude Code