Show menu section if user has access to at least one of its pages

[winterhazel]

Description

As reported in #8713 (comment), the Storage section in the sidebar is not displayed to users when they do not have permission to the API listVolumesMetrics. However, roles can have permissions to other APIs, such as listBackups and listSnapshots, in which case the section should be displayed. This situation is not exclusive to the Storage section.

This PR fixes this issue by changing how the routes are filtered. Now, sections will be shown if they have at least one visible child. For other routes, the previous logic is still applied.

Closes #8730.

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)

Feature/Enhancement Scale or Bug Severity

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

Screenshots (if appropriate):

Here's how the menu looks like before (left) and after the changes (right) for a user that does not have permission for listVolumesMetrics:

How Has This Been Tested?

1. I created a role v, based on the role User, that had access to listSnapshots and listBuckets, but did not have to listVolumesMetrics;
2. I created an account v using role v;
3. I accessed the UI using account v;
4. I verified that the Storage section was shown, having the Volume Snapshots and Buckets pages;
5. I verified that the other sections did not change;
6. I clicked the Storage section and verified that I was redirected to the Volume Snapshots page;
7. I denied listSnaphots and listBuckets for role v;
8. I logged out, cleared my cache and logged in again. I verified that the Storage section was not shown anymore.

[winterhazel]

@blueorangutan package

[blueorangutan]

@winterhazel a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

[BryanMLima]

@blueorangutan ui

[blueorangutan]

@BryanMLima a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress.

[blueorangutan]

UI build: ✔️
Live QA URL: https://qa.cloudstack.cloud/simulator/pr/8978 (QA-JID-322)

[blueorangutan]

Packaging result [SF]: ✔️ el7 ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 9429

[bernardodemarco]

LGTM, I've manually tested the PR in the QA environment.

1. I created a role based on the User role.
2. I denied the role's access to listNetworks and listVolumesMetrics APIs.
3. I created an account using the custom role.
4. I checked that the Storage and Network sections and their subsections are being displayed correctly.

Storage section

Network section

Great fix, @winterhazel!

[DaanHoogland]

@blueorangutan ui

[blueorangutan]

@DaanHoogland a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress.

[blueorangutan]

UI build: ✔️
Live QA URL: https://qa.cloudstack.cloud/simulator/pr/8978 (QA-JID-324)

[DaanHoogland]

@winterhazel @bernardodemarco I tried this in qa:

I created a role based on the Read-Only User role.
I denied the role's access to listVirtualMachines, listNetworks, listVolumes and listTemplates APIs.
I created an account using the custom role.
I tried to log in but could not.

to double check I created a "regular" Read-Only user and could log in.

[winterhazel]

@winterhazel @bernardodemarco I tried this in qa:

I created a role based on the Read-Only User role.
I denied the role's access to listVirtualMachines, listNetworks, listVolumes and listTemplates APIs.
I created an account using the custom role.
I tried to log in but could not.

to double check I created a "regular" Read-Only user and could log in.

Hey @DaanHoogland, I reproduced your steps in QA and was able to log in. I created the account t (password is also t).

I suppose that the user you created was cripple. I verified that it did not have access to listZones, which is an API users are unable to login without. This behavior has nothing to do with the changes here, and you can verify that this account is unable to login in the QA of other PRs as well.

[DaanHoogland]

I suppose that the user you created was cripple. I verified that it did not have access to listZones, which is an API users are unable to login without. This behavior has nothing to do with the changes here, and you can verify that this account is unable to login in the QA of other PRs as well.

you are right, I added listZones and cripple can login with all menus available. 👍