percona
diff --git a/‎changelog.d/SEP-1844.changed.md‎
Lines changed: 1 addition & 0 deletions b/‎changelog.d/SEP-1844.changed.md‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎frontend/packages/api/src/auth-context.ts‎
Lines changed: 151 additions & 0 deletions b/‎frontend/packages/api/src/auth-context.ts‎
Lines changed: 151 additions & 0 deletions
diff --git a/‎frontend/packages/api/src/index.ts‎
Lines changed: 11 additions & 0 deletions b/‎frontend/packages/api/src/index.ts‎
Lines changed: 11 additions & 0 deletions
diff --git a/‎frontend/packages/api/tests/auth-context.test.ts‎
Lines changed: 93 additions & 0 deletions b/‎frontend/packages/api/tests/auth-context.test.ts‎
Lines changed: 93 additions & 0 deletions
diff --git a/‎frontend/packages/apps/alerts/src/AlertsListPage.tsx‎
Lines changed: 51 additions & 40 deletions b/‎frontend/packages/apps/alerts/src/AlertsListPage.tsx‎
Lines changed: 51 additions & 40 deletions
@@ -0,0 +1 @@
+Non-administrator sessions no longer see per-app create, execute, stop, retry or delete controls in the React UI: every such control is hidden rather than offered and answered with a 403. This is a UI-only change and never a security boundary — the server-side gate is unchanged and remains the only one. Reads are untouched, so a non-administrator keeps every list, detail, log and history view; the pages they are left with are read-only, which for some apps means a sparse view with no actions. Where the withheld control was a whole form — the ATW collect pane, Dipper's execution form, a snippet's execute accordion — a short notice takes its place rather than leaving blank space. Which sessions this affects depends on the auth provider: Casdoor defaults new users to non-administrator, and the Grafana provider grants administrator only from `isGrafanaAdmin` or an Admin org role. The UI still keys on the administrator flag alone, so a session holding a lesser role that the server would accept (an `editor` on Alert Templates' push and restore) is offered no control for it yet.
@@ -0,0 +1,151 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { createContext, useContext, useMemo } from 'react';
+import type { User } from './types/api';
+
+/**
+ * Session state owned by the shell's ``AuthProvider``.
+ *
+ * The context lives here, at the root of the frontend dependency graph, so the
+ * framework and every app package can read it — they all depend on ``@sep/api``
+ * and none of them may depend on ``@sep/shell``. The provider itself, and all
+ * token/session bookkeeping, stays in the shell.
+ *
+ * One context carries both the session and the capability derived from it, so a
+ * silent-refresh token rotation re-renders every capability consumer too. That
+ * is a handful of controls every few minutes; splitting the capability into its
+ * own context is the fix if it ever costs more than it saves.
+ */
+export interface AuthSession {
+  user: User | null;
+  accessToken: string | null;
+  isAuthenticated: boolean;
+  /**
+   * Administrator identity. Read this only for genuinely admin-only surfaces
+   * (the shell's Settings / Admin Apps pages and their query suppression). Per-app
+   * write controls gate on {@link AuthState.canMutate} instead.
+   */
+  isAdmin: boolean;
+  /** true during initial session bootstrap & during login */
+  loading: boolean;
+  /** true after the initial session check finishes (success or failure) */
+  ready: boolean;
+  login: (username: string, password: string) => Promise<void>;
+  logout: () => Promise<void>;
+}
+
+/** {@link AuthSession} plus the capabilities derived from it. */
+export interface AuthState extends AuthSession {
+  /**
+   * Whether this session may mutate: the gate every per-app create / execute /
+   * stop / retry / delete control reads.
+   *
+   * Semantically distinct from {@link AuthSession.isAdmin} even though it is
+   * exactly that today. The server already resolves a minimum role per route
+   * rather than one administrator flag, and ``User`` carries that role, so
+   * widening the UI to match is an edit to {@link deriveCanMutate} —
+   * per-control minimum roles — and to no call site.
+   */
+  canMutate: boolean;
+}
+
+/**
+ * Single derivation of "may this session mutate?" from session state.
+ *
+ * Deliberately the administrator flag and nothing finer: most unsafe routes
+ * require ``admin``, so keying on a lesser role here would put back the
+ * controls that answer 403. Widening this to a per-control minimum role is the
+ * follow-up that {@link AuthState.canMutate} describes.
+ */
+export function deriveCanMutate(session: AuthSession): boolean {
+  return session.isAdmin;
+}
+
+/**
+ * Resolved state for a consumer rendered outside an ``AuthProvider``: signed
+ * out, non-admin, and therefore unable to mutate. Tests and Storybook renders
+ * mount framework/app components without the shell's provider, so a missing
+ * provider must degrade to the least-privileged state rather than throw.
+ */
+export const UNAUTHENTICATED_SESSION: AuthSession = Object.freeze({
+  user: null,
+  accessToken: null,
+  isAuthenticated: false,
+  isAdmin: false,
+  loading: false,
+  ready: false,
+  login: async () => {},
+  logout: async () => {},
+});
+
+/**
+ * Session state for a signed-in administrator: the mirror of
+ * {@link UNAUTHENTICATED_SESSION}, and the fixture every "an admin still sees
+ * this control" render needs.
+ *
+ * A test fixture living in shipped code, deliberately. It belongs beside the
+ * constant it mirrors, and the alternative — a ``@sep/test-utils`` export —
+ * would drag ``@sep/api`` into every package's vitest setup file, where the
+ * eagerly-loaded real module defeats ``vi.mock('@sep/api')`` in suites that
+ * have nothing to do with auth.
+ *
+ * Do not hand this to ``AuthContext`` in application code: the shell's
+ * ``AuthProvider`` owns the real session, and a hardcoded admin one only
+ * unlocks controls the API still refuses.
+ */
+export const ADMIN_SESSION: AuthSession = Object.freeze({
+  ...UNAUTHENTICATED_SESSION,
+  isAuthenticated: true,
+  isAdmin: true,
+  ready: true,
+});
+
+export const AuthContext = createContext<AuthSession | null>(null);
+
+let warnedMissingProvider = false;
+
+/**
+ * Warn once per bundle when the provider is missing. Hiding controls is a
+ * quieter failure than the throw this replaced, so a stray consumer mounted
+ * outside the provider would otherwise silently look like a non-admin session.
+ */
+function warnMissingProvider(): void {
+  if (warnedMissingProvider || !import.meta.env?.DEV) {
+    return;
+  }
+  warnedMissingProvider = true;
+  // eslint-disable-next-line no-console -- surface a silently degraded session in dev
+  console.warn(
+    'useAuth() was called outside an AuthProvider — falling back to a signed-out, ' +
+      'non-admin session. Mutation controls will be hidden.',
+  );
+}
+
+/**
+ * Read the current session and its derived capabilities.
+ *
+ * Resolves to {@link UNAUTHENTICATED_SESSION} when no provider is mounted.
+ */
+export function useAuth(): AuthState {
+  const session = useContext(AuthContext);
+  if (!session) {
+    warnMissingProvider();
+  }
+  const resolved = session ?? UNAUTHENTICATED_SESSION;
+  return useMemo(() => ({ ...resolved, canMutate: deriveCanMutate(resolved) }), [resolved]);
+}
@@ -37,6 +37,17 @@ export { createQueryClient, defaultQueryClientConfig } from './queryClient';
 export { ApiError, normalizeAxiosError, parseFieldErrors } from './errors';
 export type { ApiErrorDetails, ApiErrorKind, FieldValidationError } from './errors';
 
+// Auth context (provider lives in @sep/shell; the context lives here so the
+// framework and app packages can read it without depending on the shell)
+export {
+  ADMIN_SESSION,
+  AuthContext,
+  UNAUTHENTICATED_SESSION,
+  deriveCanMutate,
+  useAuth,
+} from './auth-context';
+export type { AuthSession, AuthState } from './auth-context';
+
 // Auth
 export {
   postLogin,
 
@@ -0,0 +1,93 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+import {
+  ADMIN_SESSION,
+  UNAUTHENTICATED_SESSION,
+  deriveCanMutate,
+  type AuthSession,
+} from '../src/auth-context';
+
+function session(overrides: Partial<AuthSession> = {}): AuthSession {
+  return { ...UNAUTHENTICATED_SESSION, ...overrides };
+}
+
+describe('deriveCanMutate', () => {
+  it('grants mutation to an administrator', () => {
+    expect(deriveCanMutate(session({ isAdmin: true, isAuthenticated: true }))).toBe(true);
+  });
+
+  it('withholds mutation from an authenticated non-administrator', () => {
+    expect(deriveCanMutate(session({ isAdmin: false, isAuthenticated: true }))).toBe(false);
+  });
+
+  it('withholds mutation from a signed-out session', () => {
+    expect(deriveCanMutate(UNAUTHENTICATED_SESSION)).toBe(false);
+  });
+
+  it('keys on the administrator flag alone, not on authentication', () => {
+    // The server resolves a minimum role per route; the UI deliberately keys on
+    // the one flag, so widening it stays a single-function change.
+    expect(deriveCanMutate(session({ isAdmin: true, isAuthenticated: false }))).toBe(true);
+  });
+});
+
+describe('UNAUTHENTICATED_SESSION', () => {
+  it('is the least-privileged session a missing provider can resolve to', () => {
+    expect(UNAUTHENTICATED_SESSION.isAdmin).toBe(false);
+    expect(UNAUTHENTICATED_SESSION.isAuthenticated).toBe(false);
+    expect(UNAUTHENTICATED_SESSION.user).toBeNull();
+    expect(UNAUTHENTICATED_SESSION.accessToken).toBeNull();
+  });
+
+  it('is frozen, so a consumer cannot escalate the shared fallback', () => {
+    expect(Object.isFrozen(UNAUTHENTICATED_SESSION)).toBe(true);
+    expect(() => {
+      (UNAUTHENTICATED_SESSION as { isAdmin: boolean }).isAdmin = true;
+    }).toThrow();
+    expect(UNAUTHENTICATED_SESSION.isAdmin).toBe(false);
+  });
+
+  it('resolves its no-op login and logout without throwing', async () => {
+    await expect(UNAUTHENTICATED_SESSION.login('u', 'p')).resolves.toBeUndefined();
+    await expect(UNAUTHENTICATED_SESSION.logout()).resolves.toBeUndefined();
+  });
+});
+
+describe('ADMIN_SESSION', () => {
+  it('is a session that may mutate, so an "admin still sees it" render is a real admin', () => {
+    expect(ADMIN_SESSION.isAdmin).toBe(true);
+    expect(ADMIN_SESSION.isAuthenticated).toBe(true);
+    expect(ADMIN_SESSION.ready).toBe(true);
+    expect(deriveCanMutate(ADMIN_SESSION)).toBe(true);
+  });
+
+  it('is frozen, so one test cannot mutate the fixture the next one reads', () => {
+    expect(Object.isFrozen(ADMIN_SESSION)).toBe(true);
+    expect(() => {
+      (ADMIN_SESSION as { isAdmin: boolean }).isAdmin = false;
+    }).toThrow();
+    expect(ADMIN_SESSION.isAdmin).toBe(true);
+  });
+
+  it('leaves the shared fallback alone', () => {
+    // Built by spreading UNAUTHENTICATED_SESSION: a spread that mutated its
+    // source would hand every provider-less consumer an administrator.
+    expect(UNAUTHENTICATED_SESSION.isAdmin).toBe(false);
+  });
+});
@@ -35,6 +35,7 @@ import {
 import ExpandMoreIcon from '@mui/icons-material/ExpandMore';
 import NotificationsActiveIcon from '@mui/icons-material/NotificationsActive';
 import SettingsIcon from '@mui/icons-material/Settings';
+import { useAuth } from '@sep/api';
 import { useAlertBackups, useAlertsIndex } from './hooks';
 import { AlertsWizard } from './AlertsWizard';
 import type { AlertTemplate, WizardMode } from './types';
@@ -54,6 +55,7 @@ const SEVERITY_COLORS: Record<string, 'default' | 'info' | 'warning' | 'error'>
  * AlertsWizard dialog.
  */
 export function AlertsListPage() {
+  const { canMutate } = useAuth();
   const { data, isLoading, error } = useAlertsIndex();
 
   const [selected, setSelected] = useState<Set<string>>(new Set());
@@ -133,30 +135,34 @@ export function AlertsListPage() {
               PMM not connected
             </Alert>
           )}
-          <Button
-            variant="contained"
-            startIcon={<NotificationsActiveIcon />}
-            disabled={selected.size === 0 || !data?.pmm_connected}
-            onClick={() => openWizard('push')}
-          >
-            Push Selected ({selected.size})
-          </Button>
-          <Button
-            variant="outlined"
-            onClick={() => openWizard('restore')}
-            disabled={(data?.recent_backups ?? []).length === 0}
-          >
-            Restore from Backup
-          </Button>
-          <Button
-            variant="outlined"
-            startIcon={<SettingsIcon />}
-            onClick={() => openWizard('pagerduty')}
-            disabled={!data?.pmm_connected}
-            color={pagerdutyConfigured ? 'success' : 'primary'}
-          >
-            {pagerdutyConfigured ? 'PagerDuty Configured ✓' : 'Configure PagerDuty'}
-          </Button>
+          {canMutate && (
+            <>
+              <Button
+                variant="contained"
+                startIcon={<NotificationsActiveIcon />}
+                disabled={selected.size === 0 || !data?.pmm_connected}
+                onClick={() => openWizard('push')}
+              >
+                Push Selected ({selected.size})
+              </Button>
+              <Button
+                variant="outlined"
+                onClick={() => openWizard('restore')}
+                disabled={(data?.recent_backups ?? []).length === 0}
+              >
+                Restore from Backup
+              </Button>
+              <Button
+                variant="outlined"
+                startIcon={<SettingsIcon />}
+                onClick={() => openWizard('pagerduty')}
+                disabled={!data?.pmm_connected}
+                color={pagerdutyConfigured ? 'success' : 'primary'}
+              >
+                {pagerdutyConfigured ? 'PagerDuty Configured ✓' : 'Configure PagerDuty'}
+              </Button>
+            </>
+          )}
         </Box>
       </Box>
 
@@ -173,16 +179,19 @@ export function AlertsListPage() {
             <Accordion key={group.service_type} disableGutters sx={{ mb: 1 }}>
               <AccordionSummary expandIcon={<ExpandMoreIcon />}>
                 <Box sx={{ display: 'flex', alignItems: 'center', gap: 1 }}>
-                  <Checkbox
-                    checked={allChecked}
-                    indeterminate={someChecked && !allChecked}
-                    onClick={(e) => {
-                      e.stopPropagation();
-                      toggleGroup(groupNames);
-                    }}
-                    size="small"
-                    inputProps={{ 'aria-label': `Select all ${group.label} templates` }}
-                  />
+                  {/* Selection exists only to feed Push Selected, so both go together. */}
+                  {canMutate && (
+                    <Checkbox
+                      checked={allChecked}
+                      indeterminate={someChecked && !allChecked}
+                      onClick={(e) => {
+                        e.stopPropagation();
+                        toggleGroup(groupNames);
+                      }}
+                      size="small"
+                      inputProps={{ 'aria-label': `Select all ${group.label} templates` }}
+                    />
+                  )}
                   <Typography variant="subtitle1" fontWeight={500}>
                     {group.label} ({group.templates.length})
                   </Typography>
@@ -205,12 +214,14 @@ export function AlertsListPage() {
                           py: 0.5,
                         }}
                       >
-                        <Checkbox
-                          checked={selected.has(template.name)}
-                          onChange={() => toggleTemplate(template.name)}
-                          size="small"
-                          inputProps={{ 'aria-label': template.name }}
-                        />
+                        {canMutate && (
+                          <Checkbox
+                            checked={selected.has(template.name)}
+                            onChange={() => toggleTemplate(template.name)}
+                            size="small"
+                            inputProps={{ 'aria-label': template.name }}
+                          />
+                        )}
                         <Box sx={{ flex: 1, minWidth: 0 }}>
                           <Box sx={{ display: 'flex', alignItems: 'center', gap: 1 }}>
                             <Typography variant="body2" fontWeight={500}>
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	+Non-administrator sessions no longer see per-app create, execute, stop, retry or delete controls in the React UI: every such control is hidden rather than offered and answered with a 403. This is a UI-only change and never a security boundary — the server-side gate is unchanged and remains the only one. Reads are untouched, so a non-administrator keeps every list, detail, log and history view; the pages they are left with are read-only, which for some apps means a sparse view with no actions. Where the withheld control was a whole form — the ATW collect pane, Dipper's execution form, a snippet's execute accordion — a short notice takes its place rather than leaving blank space. Which sessions this affects depends on the auth provider: Casdoor defaults new users to non-administrator, and the Grafana provider grants administrator only from `isGrafanaAdmin` or an Admin org role. The UI still keys on the administrator flag alone, so a session holding a lesser role that the server would accept (an `editor` on Alert Templates' push and restore) is offered no control for it yet.