Repository navigation
[Throwaway] Editor secret tips on shared remote pipelines - #2857
Draft
morgan-wowk wants to merge 1 commit into
Draft
morgan-wowk wants to merge 1 commit into
morgan-wowk wants to merge 1 commit into
Conversation
Do not merge. A preview of the editor experience for the access-control MVP,
built on the remote pipeline stack so the screenshots show the real editor.
- A non-owner whose my_scopes includes pipeline:update can edit the pipeline.
Their saves go to PUT /api/pipelines/{id}, which applies the owner-only
secrets guard; owners keep saving through /api/users/me/pipelines.
- Tasks that take a secret are read-only for that editor, with one line naming
who can change them.
- "Select Secret..." becomes a short tip to ask the owner.
🎩 PreviewA preview build has been created at: |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Warning
Throwaway, do not merge. This shows the editor experience the access-control MVP is aiming for. It's built on top of #2821 so the screenshots show the real remote-pipeline editor. Once remote editing lands, the real version should be rebuilt on that work.
Someone with edit on another person's saved pipeline can now change it. Secrets stay with the owner. Instead of refusing the save, the editor explains where the limit is and names the person to ask.
What the editor sees
A task that takes a secret is read-only, with one line saying who can change it:
Adding a secret becomes a tip to ask the owner:
Everything else saves as usual. The e2e test changes
epochson the other task and checks that the save leaves the secret task untouched.Changes
RemotePipelineFile.canEditalso allows a non-owner whoseGET /api/access_control/pipeline/{id}/my_scopesincludespipeline:update. Without an edit grant (or on a backend without the endpoint) the pipeline stays read-only.PUT /api/pipelines/{id}, where the backend checks edit access and the secrets rule. Owners still save through/api/users/me/pipelines. Deleting stays owner-only.PipelineFile.secretsOwnernames the owner when the viewer isn't the owner:ArgumentRowlocks every argument of a task that takes a secret and shows aFieldMessagetip.DynamicDataSubmenureplaces "Select Secret..." with "Ask to add secrets."Not covered
Deleting a secret task or swapping its component isn't blocked here. The backend still refuses that save with "Secrets are owner-only: save your other edits, then ask .", which shows in the Retry tooltip.
Related
🤖 Generated with Claude Code