86 adicionar mais roles - #89
Conversation
The latest updates on your projects. Learn more about Vercel for GitHub.
|
WalkthroughRefactors permissions to be view-gated across content and forms, expands RolesConfig with new can_view_* flags and hidden_forms, tightens access-control logic and hooks, adds setor support and UI changes in admin/users, and updates CompleteProfileModal setor options. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor User
participant App
participant AccessControl
participant RoleConfig
User->>App: Navigate to Events page
App->>AccessControl: canViewEvents(RoleConfig)
AccessControl->>RoleConfig: check sudo or content.can_view_events
alt view allowed
App->>AccessControl: canCreateEvent(RoleConfig)
AccessControl->>RoleConfig: require can_view_events then can_create_event
App-->>User: Render Events (create UI gated)
else view denied
App-->>User: Redirect / show unauthorized
end
sequenceDiagram
autonumber
actor Admin
participant AdminUI as Admin Users Page
participant Helpers as Permission Helpers
participant RoleCfg as RoleConfig
Admin->>AdminUI: Toggle "Eventos" view
AdminUI->>Helpers: handlePermissionToggle('can_view_events')
Helpers->>RoleCfg: Set content.can_view_events
alt enabling
Helpers->>RoleCfg: Optionally enable related can_create_event
AdminUI-->>Admin: Toast "Eventos: visualização ativada"
else disabling
Helpers->>RoleCfg: Clear dependent flags (e.g., can_create_event)
AdminUI-->>Admin: Toast "Eventos: visualização desativada"
end
Admin->>AdminUI: Toggle Sudo
AdminUI->>RoleCfg: Set sudo = true
AdminUI->>RoleCfg: Clear admin_pages, accessible_routes, content, forms
AdminUI-->>Admin: Toast "Sudo ativado (outros campos limpos)"
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Poem
✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File ( |
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
src/app/(authenticated)/events/page.tsx (1)
27-29: Prefer AccessDenied fallback over redirect (optional).Guidelines suggest showing an AccessDenied fallback for unauthorized users instead of redirecting.
Apply:
- if (!canViewEvents(userData.role_config)) {- redirect("/dashboard")- }+ if (!canViewEvents(userData.role_config)) {+ return <AccessDenied />+ }And ensure the import exists:
import{AccessDenied}from"@/components/access-denied"src/app/(authenticated)/flyers/page.tsx (1)
26-28: Optional: render AccessDenied instead of redirect.Keeps UX consistent with unauthorized fallbacks.
- if (!canViewFlyers(userData.role_config)) {- redirect("/dashboard")- }+ if (!canViewFlyers(userData.role_config)) {+ return <AccessDenied />+ }Import if needed:
import{AccessDenied}from"@/components/access-denied"src/app/(authenticated)/cars/page.tsx (1)
35-37: Optional UX: show AccessDenied instead of redirect.Consistent unauthorized handling across authenticated routes.
- if (!canViewCars(userData.role_config)) {- redirect("/dashboard")- }+ if (!canViewCars(userData.role_config)) {+ return <AccessDenied />+ }Add import if missing:
import{AccessDenied}from"@/components/access-denied"
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
src/app/(authenticated)/cars/page.tsx(1 hunks)src/app/(authenticated)/events/page.tsx(1 hunks)src/app/(authenticated)/flyers/page.tsx(1 hunks)
🧰 Additional context used
📓 Path-based instructions (7)
**/*.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/00-quick-reference.mdc)
**/*.{ts,tsx}: Use path aliases (e.g., @/components/ui/button, @/trpc/react, @/lib/utils, and type-only imports) instead of long relative paths
Avoid long multi-level relative imports like ../../../components/ui/button
Document functions with JSDoc for clarity on params and return values
Do not use any unnecessarily; prefer precise types
**/*.{ts,tsx}: Evitar usar any; preferir tipos específicos ou unknown
Usar interface para objetos e type para uniões/tipos utilitários
Definir tipos de retorno explícitos para funções
Usar import type para importar somente tipos; evitar import de valores quando apenas tipos são necessários
**/*.{ts,tsx}: In component props interfaces, list required props first, then optional props; include className as an optional prop at the end
Group imports in the order: React, external libraries, internal components, types, then utils
**/*.{ts,tsx}: Prefer select to avoid fetching all fields in Prisma queries
Use transactions (db.$transaction) for related operations and use the transactional client (tx) inside the callback
Fetch related data in a single optimized query using nested selects/filters/order/limit instead of multiple sequential queries
**/*.{ts,tsx}: Validate all API inputs with Zod schemas and pass them to procedures (e.g., protectedProcedure.input(schema))
Use separate schemas for create and update; derive update schemas with schema.partial().extend({ id: z.string().cuid() })
Enforce authorization inside mutations (e.g., deny user updates unless sudo or self) and return FORBIDDEN on violations
Validate file uploads with Zod: enforce max size (≤5MB) and whitelist MIME types (image/jpeg, image/png, image/webp)
Do not expose sensitive data in API responses; select only required fields from the database
Log internal errors for monitoring, but return generic, non-sensitive messages to clients (e.g., TRPCError with INTERNAL_SERVER_ERROR)
Implement rate limiting on sensitive routes (e.g., /api/auth) using express-rate-limit ...
Files:
src/app/(authenticated)/cars/page.tsxsrc/app/(authenticated)/events/page.tsxsrc/app/(authenticated)/flyers/page.tsx
src/**/*.tsx
📄 CodeRabbit inference engine (.cursor/rules/00-quick-reference.mdc)
src/**/*.tsx: Define React component props with a TypeScript interface and include optional className to merge via cn
Use the design system components (e.g., Card, Button) and compose classes with cn for consistent UI
Build forms with React Hook Form and Zod (zodResolver), show field errors, and disable submit while isSubmitting
Memoize expensive computations with useMemo and event handlers with useCallback; use React.memo where beneficial
Files:
src/app/(authenticated)/cars/page.tsxsrc/app/(authenticated)/events/page.tsxsrc/app/(authenticated)/flyers/page.tsx
**/*.tsx
📄 CodeRabbit inference engine (.cursor/rules/02-react-components.mdc)
**/*.tsx: Only add the "use client" directive at the top of a file when a component truly needs to run on the client
When destructuring props in a React component, keep the order: required props, then optional props, then className
Place state hooks (useState) at the top of the component before any effects or functions
Place effects (useEffect) after state declarations
Define component functions/handlers after hooks (state/effects)
Use the cn utility to merge class names when applying className to elements
Use React.forwardRef for components that need to receive a ref
Always set displayName on components created with React.forwardRef
Wrap functions passed as props with useCallback
Memoize expensive computations with useMemoSanitize any user-provided HTML before rendering with DOMPurify.sanitize, allowing only safe tags/attributes
**/*.tsx: Use React Hook Form with Zod (zodResolver) for validation in React forms
Implement accessibility on form fields: associate Label htmlFor with input id, set aria-invalid when errors exist, and link error text via aria-describedby
Provide clear visual feedback for field errors by rendering error messages near inputs and linking them with matching ids
Use formState.isSubmitting to show a loading state and disable the submit button during submission
Reset the form and trigger onSuccess after a successful submit; wrap submit logic in try/catch to handle errors
When editing entities, initialize form defaultValues from the provided data
Use Controller to integrate custom or controlled components (e.g., Select) with React Hook Form and surface validation errors
Validate file uploads on the client: enforce accept and maxSize, preview images using Object URLs when applicable, and allow removing the selected file
Files:
src/app/(authenticated)/cars/page.tsxsrc/app/(authenticated)/events/page.tsxsrc/app/(authenticated)/flyers/page.tsx
src/**/*.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/03-imports-file-structure.mdc)
src/**/*.{ts,tsx}: Use TypeScript path aliases (e.g., @/components, @/lib, @/types) instead of long relative import paths
Order imports with the following groups: 1) React imports, 2) external libraries (alphabetically), 3) internal alias-based imports (ordered by alias), 4) type-only imports, 5) asset imports
Use kebab-case for file names (e.g., user-profile.tsx)
Use camelCase for functions and hooks (e.g., useUserProfile)
Use PascalCase for type and interface names (e.g., UserProfileData)
Use SCREAMING_SNAKE_CASE for constants (e.g., DEFAULT_PAGE_SIZE)
Place type-only imports after value imports within the imports block
Place asset imports after code and type imports within the imports block
Alphabetize external library imports within their group
Order internal alias-based imports by alias name within their group
src/**/*.{ts,tsx}: Arquivos de código TypeScript devem ser nomeados em kebab-case (ex.: user-profile.tsx)
Funções e hooks devem usar camelCase (ex.: useUserProfile)
Constantes devem usar SCREAMING_SNAKE_CASE
Sempre usar o alias @/ para imports internos
Agrupar imports por categoria (externos, internos, locais, etc.)
Ordenar imports alfabeticamente dentro de cada grupo
Files:
src/app/(authenticated)/cars/page.tsxsrc/app/(authenticated)/events/page.tsxsrc/app/(authenticated)/flyers/page.tsx
src/app/**
📄 CodeRabbit inference engine (.cursor/rules/03-imports-file-structure.mdc)
Place Next.js App Router pages under src/app
Files:
src/app/(authenticated)/cars/page.tsxsrc/app/(authenticated)/events/page.tsxsrc/app/(authenticated)/flyers/page.tsx
**/*.{tsx,jsx}
📄 CodeRabbit inference engine (.cursor/rules/06-ui-ux-patterns.mdc)
**/*.{tsx,jsx}: Preferir componentes do shadcn/ui (ex.: Button, Card, Input) importados de "@/components/ui/*" em vez de estilos customizados
Usar consistentemente componentes do design system (ex.: Button, Card, Input) nas UIs ao invés de HTML ad‑hoc
Usar a função cn() de "@/lib/utils" para compor className em vez de concatenação manual de strings
Preferir classes/tokens semânticos do design system (ex.: text-muted-foreground, btn-primary e seus estados hover/focus) em vez de estilos arbitrários
Construir layouts responsivos com Tailwind (ex.: grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3, gap controlado)
Usar padrões de Flexbox com utilitários Tailwind (ex.: flex, flex-col, items-center, justify-between, space-y-4) em vez de CSS customizado
Fornecer estados de loading e erro em componentes de dados usando Skeleton e Alert (variant="destructive")
Marcar ícones puramente decorativos com aria-hidden="true" e fornecer rótulos acessíveis (aria-label) para botões
Desabilitar interações conforme estado (ex.: disabled durante loading) em elementos interativos
Formulários acessíveis: associar Label htmlFor ao Input id, usar aria-describedby para mensagens de erro e aria-invalid quando aplicável
Usar tokens/variáveis de tema do Tailwind para cores (ex.: text-primary, bg-secondary) em vez de cores hardcoded
Suportar modo escuro usando o prefixo dark: nas classes Tailwind quando pertinente
**/*.{tsx,jsx}: Use React.memo for components that re-render frequently
Memoize expensive computations with useMemo
Use useCallback for functions passed as props to child components
Virtualize large lists (e.g., react-window) instead of rendering all items
Use lazy loading/code splitting (React.lazy/Suspense or dynamic import) for heavy components and pages
Optimize images using Next.js Image with proper sizes, priority, and blur placeholders
Use debounce for search and similar high-frequency inputs to reduce request frequency
Use throttle for scroll/resize or other frequent events to...
Files:
src/app/(authenticated)/cars/page.tsxsrc/app/(authenticated)/events/page.tsxsrc/app/(authenticated)/flyers/page.tsx
**/*.{tsx,ts}
📄 CodeRabbit inference engine (.cursor/rules/07-security-access-control.mdc)
Guard privileged UI and route-entry points with permission checks (e.g., hasPermission('admin_pages.view_dashboard')) and show an AccessDenied fallback when unauthorized
Files:
src/app/(authenticated)/cars/page.tsxsrc/app/(authenticated)/events/page.tsxsrc/app/(authenticated)/flyers/page.tsx
🧠 Learnings (2)
📚 Learning: 2025-09-03T14:06:35.724Z
Learnt from: CR
PR: GRHInvDev/elo#0
File: .cursor/rules/07-security-access-control.mdc:0-0
Timestamp: 2025-09-03T14:06:35.724Z
Learning: Applies to **/*.{tsx,ts} : Guard privileged UI and route-entry points with permission checks (e.g., hasPermission('admin_pages.view_dashboard')) and show an AccessDenied fallback when unauthorized
Applied to files:
src/app/(authenticated)/cars/page.tsxsrc/app/(authenticated)/flyers/page.tsx
📚 Learning: 2025-09-03T14:06:35.724Z
Learnt from: CR
PR: GRHInvDev/elo#0
File: .cursor/rules/07-security-access-control.mdc:0-0
Timestamp: 2025-09-03T14:06:35.724Z
Learning: Applies to **/use-access-control.{ts,tsx} : Provide a centralized access-control hook (useAccessControl) that exposes hasPermission and hasRole, checks sudo via user.role_config.sudo, and delegates specific checks to checkPermission
Applied to files:
src/app/(authenticated)/events/page.tsxsrc/app/(authenticated)/flyers/page.tsx
🧬 Code graph analysis (3)
src/app/(authenticated)/cars/page.tsx (1)
src/lib/access-control.ts (1)
canViewCars(178-186)
src/app/(authenticated)/events/page.tsx (1)
src/lib/access-control.ts (1)
canViewEvents(148-156)
src/app/(authenticated)/flyers/page.tsx (1)
src/lib/access-control.ts (1)
canViewFlyers(158-166)
🔇 Additional comments (3)
src/app/(authenticated)/events/page.tsx (1)
27-29: Switched to role-based view check — correct and consistent.Passing userData.role_config matches canViewEvents(roleConfig) and safely blocks when null/absent.
src/app/(authenticated)/flyers/page.tsx (1)
26-28: Role-config-based gate looks good.Using canViewFlyers(userData.role_config) aligns with the updated access-control API.
src/app/(authenticated)/cars/page.tsx (1)
35-37: Updated permission check is correct.canViewCars(userData.role_config) matches the new signature and prevents access when role_config is null.
| if (!canViewEvents(userData.role_config)) { | ||
| redirect("/dashboard") | ||
| } |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Verify all view checks now pass role_config.
Scan for any leftover zero-arg calls to canViewEvents/canViewFlyers/canViewCars.
🏁 Script executed:
#!/bin/bash# Find zero-argument calls that should be passing role_configset -euo pipefail
echo"Calls missing role_config:"
rg -nP --glob 'src/**/*.{ts,tsx}''\bcanView(?:Events|Flyers|Cars)\s*\(\s*\)' -S ||trueechoecho"Optionally, confirm create helpers are also passing role_config:"
rg -nP --glob 'src/**/*.{ts,tsx}''\bcanCreate(?:Event|Flyer)\s*\(\s*\)' -S ||trueLength of output: 536
Pass role_config to creation permission checks
- Update calls to
canCreateEvent()andcanCreateFlyer()tocanCreateEvent(userData.role_config)/canCreateFlyer(userData.role_config)in:
•src/components/create-event-button.tsx:63
•src/components/create-flyer-button.tsx:173
Uh oh!
There was an error while loading. Please reload this page.
Summary by CodeRabbit
New Features
UI/UX Enhancements