feat(access-control): govern access requests per permission item by waleedlatif1 · Pull Request #9483 · simstudioai/sim

waleedlatif1 · 2026-10-30T21:16:22Z

Summary

Add Allowed, Can request, and Unavailable to the existing permission-group editor, with inherited child states, filtered bulk editing, and save/discard behavior.
Use one row layout across permission tabs, with aligned child controls, contextual help beside labels, and larger keyboard/click/tap help targets. Preserve existing shared-component defaults.
Enforce request eligibility in discovery, submission, and approval, including parent restrictions. Keep requestable items discoverable while organization requests are paused.
Preserve existing group behavior through optional request-policy metadata, without a database migration. Update the admin documentation and generated API artifacts.

Type of Change

New feature

Testing

Repository lint, type-check, all 62 audits, block-registry checks, test-type ratchet, and full test suite.
37 access-request integration tests against disposable PostgreSQL, including every target kind, parent restrictions, fresh-preview approval refusal, and preserved history/cancellation.
Running-app QA: 25 HTTP checks and browser flows for saved drafts, filtered bulk changes, inheritance, keyboard controls, member requests, pause behavior, and narrow layouts. JSON reports and desktop/mobile screenshots captured locally. The refinement adds 12 browser checks covering selector alignment, inherited help, keyboard dismissal, parent/child restoration, filtered bulk edits, save/reload, and 320px layouts. A reproduced Escape-dismissal failure was also verified fixed in the running app for both hover and keyboard focus, including suppression until a fresh gesture and pinned-help dismissal.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-10-30T21:16:25Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Ignored	Preview	Oct 30, 2026 11:57pm UTC

cubic-dev-ai

All reported issues were addressed across 32 files

_{This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic}

greptile-apps · 2026-10-30T21:21:42Z

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no new actionable issues remain.

Summary

Adds per-item Allowed, Can request, and Unavailable choices to permission groups.

Admins can set each permission-group item to Allowed, Can request, or Unavailable.
Access requests follow item rules and required parent restrictions.
Members can find requestable items in workspace surfaces, even while requests are paused.
Help icons offer larger, keyboard-friendly controls without changing shared defaults.

All three previous, unnumbered findings are addressed: ACCESS_OPTIONS uses as const, exported permission controls have TSDoc, and interactive help supports Escape dismissal. No new actionable issues were found.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Item and parent permissions] --> B{Access allowed?}
  B -->|Yes| C[Allowed]
  B -->|No| D{Requests blocked for item or restricted parent?}
  D -->|Yes| E[Unavailable]
  D -->|No| F[Can request]
  F --> G{Organization requests paused?}
  G -->|Yes| H[Keep visible; block submission and approval]
  G -->|No| I[Allow request and fresh approval review]

_{Reviews (5) · Last reviewed commit: "fix(access-control): dismiss floating pe..." · Reviewed by Greptile}

waleedlatif1 · 2026-10-30T21:36:21Z

@greptile

waleedlatif1 · 2026-10-30T21:36:22Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-30T21:36:28Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 32 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-30T21:57:02Z

@greptile

waleedlatif1 · 2026-10-30T21:57:03Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-30T21:57:10Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 32 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-30T23:34:12Z

@greptile

waleedlatif1 · 2026-10-30T23:34:13Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-30T23:34:19Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 34 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-30T23:58:28Z

@greptile

waleedlatif1 · 2026-10-30T23:58:29Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-30T23:58:34Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 35 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Turn on auto-fix | Re-trigger cubic}

feat(access-control): govern access requests per permission item

44d3679

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

vercel Bot deployed to Preview October 30, 2026 21:23

View deployment

fix(access-control): clarify request availability states

4912742

greptile-apps Bot reviewed Oct 30, 2026

View reviewed changes

Comment thread apps/sim/ee/access-control/components/access-state-select.tsx Resolved

Comment thread apps/sim/ee/access-control/components/permission-rows.tsx Resolved

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

vercel Bot deployed to Preview October 30, 2026 21:43

View deployment

chore(access-control): document and type permission controls

005ca14

vercel Bot temporarily deployed to Preview October 30, 2026 21:56 Inactive

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

improvement(access-control): align permission rows and contextual help

db76a84

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

Comment thread packages/emcn/src/components/info/info.tsx Resolved

greptile-apps Bot reviewed Oct 30, 2026

View reviewed changes

Comment thread packages/emcn/src/components/info/info.tsx Resolved

vercel Bot deployed to Preview October 30, 2026 23:40

View deployment

fix(access-control): dismiss floating permission help with Escape

9c9bca1

cubic-dev-ai Bot reviewed Oct 31, 2026

View reviewed changes

waleedlatif1 merged commit 854e095 into staging Oct 31, 2026
77 checks passed

waleedlatif1 deleted the codex/procured-access-requests branch October 31, 2026 00:17

Conversation

waleedlatif1 commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 30, 2026

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Oct 30, 2026 •

edited

Loading

vercel Bot commented Oct 30, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Oct 30, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading