Add campaign resource access explanations

2026-07-11 00:39:40 +02:00
parent da4c8731fc
commit 54c9881a25
6 changed files with 380 additions and 6 deletions
--- a/webui/src/api/campaigns.ts
+++ b/webui/src/api/campaigns.ts
@@ -22,6 +22,27 @@ export type CampaignShare = {

 export type CampaignShareTarget = {id: string;name: string;secondary?: string | null;};
 export type CampaignShareTargets = {users: CampaignShareTarget[];groups: CampaignShareTarget[];};
+export type AccessExplanationUser = {
+  id: string;
+  account_id?: string | null;
+  email?: string | null;
+  display_name?: string | null;
+};
+export type AccessDecisionProvenanceItem = {
+  kind: string;
+  id?: string | null;
+  label?: string | null;
+  tenant_id?: string | null;
+  source?: string | null;
+  details?: Record<string, unknown>;
+};
+export type ResourceAccessExplanationResponse = {
+  user: AccessExplanationUser;
+  resource_type: string;
+  resource_id: string;
+  action: string;
+  provenance: AccessDecisionProvenanceItem[];
+};

 export type CampaignUpdatePayload = {
  external_id?: string | null;
@@ -834,6 +855,20 @@ export async function getCampaignShareTargets(settings: ApiSettings, campaignId:
  return apiFetch<CampaignShareTargets>(settings, `/api/v1/campaigns/${campaignId}/share-targets`);
 }

+export function fetchResourceAccessExplanation(
+settings: ApiSettings,
+options: {userId: string;resourceType: string;resourceId: string;action: string;tenantId?: string | null;})
+: Promise<ResourceAccessExplanationResponse> {
+  const params = new URLSearchParams({
+    user_id: options.userId,
+    resource_type: options.resourceType,
+    resource_id: options.resourceId,
+    action: options.action
+  });
+  if (options.tenantId) params.set("tenant_id", options.tenantId);
+  return apiFetch<ResourceAccessExplanationResponse>(settings, `/api/v1/admin/access/resource-explanation?${params.toString()}`);
+}
+
 export async function getCampaignShares(settings: ApiSettings, campaignId: string): Promise<CampaignShare[]> {
  const response = await apiFetch<{shares: CampaignShare[];}>(settings, `/api/v1/campaigns/${campaignId}/shares`);
  return response.shares;
--- a/webui/src/features/campaigns/GlobalSettingsPage.tsx
+++ b/webui/src/features/campaigns/GlobalSettingsPage.tsx
@@ -217,7 +217,7 @@ export default function GlobalSettingsPage({ settings, auth, campaignId, view =
          </> :

        <>
-            {data.campaign && <CampaignAccessCard settings={settings} campaign={data.campaign} onChanged={reload} onError={setError} />}
+            {data.campaign && <CampaignAccessCard settings={settings} auth={auth} campaign={data.campaign} onChanged={reload} onError={setError} />}

            <div className="dashboard-grid below-grid">
              <Card title="i18n:govoplan-campaign.delivery_defaults.33cc3b97" collapsible>
--- a/webui/src/features/campaigns/components/CampaignAccessCard.tsx
+++ b/webui/src/features/campaigns/components/CampaignAccessCard.tsx
@@ -1,13 +1,16 @@
 import { useEffect, useMemo, useState } from "react";
-import type { ApiSettings, CampaignListItem } from "../../../types";
+import type { ApiSettings, AuthInfo, CampaignListItem } from "../../../types";
+import { KeyRound } from "lucide-react";
 import {
+  fetchResourceAccessExplanation,
  getCampaignShares,
  getCampaignShareTargets,
  revokeCampaignShare,
  updateCampaignOwner,
  upsertCampaignShare,
  type CampaignShare,
-  type CampaignShareTargets } from
+  type CampaignShareTargets,
+  type ResourceAccessExplanationResponse } from
 "../../../api/campaigns";
 import { Button } from "@govoplan/core-webui";
 import { Card } from "@govoplan/core-webui";
@@ -15,11 +18,12 @@ import { ConfirmDialog } from "@govoplan/core-webui";
 import DataGrid, { type DataGridColumn } from "../../../components/table/DataGrid";
 import { Dialog } from "@govoplan/core-webui";
 import { FormField } from "@govoplan/core-webui";
-import { StatusBadge, i18nMessage, useUnsavedDraftGuard } from "@govoplan/core-webui";
+import { StatusBadge, hasScope, i18nMessage, useUnsavedDraftGuard } from "@govoplan/core-webui";
 type TargetType = "user" | "group";

 export default function CampaignAccessCard({
  settings,
+  auth,
  campaign,
  onChanged,
  onError
@@ -28,7 +32,7 @@ export default function CampaignAccessCard({



-}: {settings: ApiSettings;campaign: CampaignListItem;onChanged: () => Promise<void>;onError: (message: string) => void;}) {
+}: {settings: ApiSettings;auth: AuthInfo;campaign: CampaignListItem;onChanged: () => Promise<void>;onError: (message: string) => void;}) {
  const [available, setAvailable] = useState<boolean | null>(null);
  const [targets, setTargets] = useState<CampaignShareTargets>({ users: [], groups: [] });
  const [shares, setShares] = useState<CampaignShare[]>([]);
@@ -40,11 +44,19 @@ export default function CampaignAccessCard({
  const [shareType, setShareType] = useState<TargetType>("user");
  const [shareTargetId, setShareTargetId] = useState("");
  const [sharePermission, setSharePermission] = useState<"read" | "write">("read");
+  const [accessExplanationOpen, setAccessExplanationOpen] = useState(false);
+  const [accessExplanation, setAccessExplanation] = useState<ResourceAccessExplanationResponse | null>(null);
+  const [accessExplanationLoading, setAccessExplanationLoading] = useState(false);
  const [busy, setBusy] = useState(false);
  const currentOwnerType: TargetType = campaign.owner_group_id ? "group" : "user";
  const currentOwnerId = campaign.owner_group_id || campaign.owner_user_id || "";
  const ownerDirty = ownerOpen && (ownerType !== currentOwnerType || ownerId !== currentOwnerId);
  const shareDirty = shareOpen && (shareType !== "user" || Boolean(shareTargetId) || sharePermission !== "read");
+  const canExplainResourceAccess =
+  hasScope(auth, "admin:users:read") ||
+  hasScope(auth, "admin:roles:read") ||
+  hasScope(auth, "access:membership:read") ||
+  hasScope(auth, "access:role:read");

  useUnsavedDraftGuard({
    dirty: ownerDirty || shareDirty,
@@ -146,6 +158,27 @@ export default function CampaignAccessCard({
    {setBusy(false);}
  }

+  async function openAccessExplanation() {
+    if (!auth.user?.id) return;
+    setAccessExplanationOpen(true);
+    setAccessExplanation(null);
+    setAccessExplanationLoading(true);
+    try {
+      setAccessExplanation(await fetchResourceAccessExplanation(settings, {
+        userId: auth.user.id,
+        resourceType: "campaign",
+        resourceId: campaign.id,
+        action: "campaigns:campaign:read",
+        tenantId: (auth.active_tenant ?? auth.tenant)?.id
+      }));
+    } catch (err) {
+      onError(err instanceof Error ? err.message : String(err));
+      setAccessExplanationOpen(false);
+    } finally {
+      setAccessExplanationLoading(false);
+    }
+  }
+
  const columns = useMemo<DataGridColumn<CampaignShare>[]>(() => [
  {
    id: "target",
@@ -170,7 +203,7 @@ export default function CampaignAccessCard({

  return (
    <>
-      <Card title="i18n:govoplan-campaign.ownership_and_sharing.867283c0" actions={<div className="button-row compact-actions"><Button onClick={() => setOwnerOpen(true)} disabled={available !== true}>i18n:govoplan-campaign.change_owner.d3ce16a8</Button><Button onClick={() => setShareOpen(true)} disabled={available !== true}>i18n:govoplan-campaign.share.09ca55ca</Button></div>}>
+      <Card title="i18n:govoplan-campaign.ownership_and_sharing.867283c0" actions={<div className="button-row compact-actions"><Button onClick={() => setOwnerOpen(true)} disabled={available !== true}>i18n:govoplan-campaign.change_owner.d3ce16a8</Button><Button onClick={() => setShareOpen(true)} disabled={available !== true}>i18n:govoplan-campaign.share.09ca55ca</Button><Button onClick={() => void openAccessExplanation()} disabled={available !== true || !canExplainResourceAccess}><KeyRound size={16} aria-hidden="true" /> i18n:govoplan-campaign.explain_access.4d5fac37</Button></div>}>
        <p><strong>i18n:govoplan-campaign.owner.719379ae</strong> {ownerLabel}</p>
        <p className="muted small-note">i18n:govoplan-campaign.permissions_define_what_a_role_may_do_ownership_.9f8baaa2</p>
        <DataGrid id={`campaign-${campaign.id}-shares`} rows={shares} columns={columns} getRowKey={(row) => row.id} emptyText={available === null ? "i18n:govoplan-campaign.loading_campaign_access.056299e3" : "i18n:govoplan-campaign.this_campaign_has_no_explicit_shares.978012d1"} />
@@ -188,7 +221,76 @@ export default function CampaignAccessCard({
        <FormField label="i18n:govoplan-campaign.access.2f81a22d"><select value={sharePermission} onChange={(event) => setSharePermission(event.target.value as "read" | "write")}><option value="read">i18n:govoplan-campaign.can_view.1b3e4006</option><option value="write">i18n:govoplan-campaign.can_edit_and_operate.77acb15e</option></select></FormField>
      </Dialog>

+      <Dialog open={accessExplanationOpen} className="campaign-access-dialog" title="i18n:govoplan-campaign.access_explanation.75ee7f62" onClose={() => { if (!accessExplanationLoading) { setAccessExplanationOpen(false); setAccessExplanation(null); } }} footer={<Button onClick={() => { setAccessExplanationOpen(false); setAccessExplanation(null); }} disabled={accessExplanationLoading}>i18n:govoplan-campaign.close.bbfa773e</Button>}>
+        <ResourceAccessExplanationContent loading={accessExplanationLoading} explanation={accessExplanation} fallbackResourceLabel={campaign.name || campaign.external_id || campaign.id} />
+      </Dialog>
+
      <ConfirmDialog open={Boolean(revokeTarget)} title="i18n:govoplan-campaign.remove_campaign_share.2c2d42eb" message="i18n:govoplan-campaign.remove_this_user_s_or_group_s_explicit_access_to.5ff07672" confirmLabel="i18n:govoplan-campaign.remove_share.69c932e1" tone="danger" busy={busy} onCancel={() => setRevokeTarget(null)} onConfirm={() => void revoke()} />
    </>);

 }
+
+function ResourceAccessExplanationContent({
+  loading,
+  explanation,
+  fallbackResourceLabel
+}: {loading: boolean;explanation: ResourceAccessExplanationResponse | null;fallbackResourceLabel: string;}) {
+  if (loading) return <p className="muted small-note">i18n:govoplan-campaign.loading_access_explanation.04a7c934</p>;
+  if (!explanation) return null;
+  const userLabel = explanation.user.display_name || explanation.user.email || explanation.user.id;
+  const resourceLabel = explanation.provenance.find((item) => item.kind === "resource")?.label || fallbackResourceLabel || explanation.resource_id;
+  return (
+    <>
+      <div className="form-grid compact responsive-form-grid">
+        <div><span className="form-label">i18n:govoplan-campaign.user.9f8a2389</span><p>{userLabel}</p></div>
+        <div><span className="form-label">i18n:govoplan-campaign.resource.d1c626a9</span><p>{resourceLabel}</p></div>
+        <div><span className="form-label">i18n:govoplan-campaign.action.97c89a4d</span><p><code>{explanation.action}</code></p></div>
+        <div><span className="form-label">i18n:govoplan-campaign.evidence.8487d192</span><p>{explanation.provenance.length}</p></div>
+      </div>
+      {explanation.provenance.length === 0 ?
+      <p className="muted small-note">i18n:govoplan-campaign.no_access_evidence_was_returned.84a21e4e</p> :
+      <div className="admin-assignment-grid">
+          {explanation.provenance.map((item, index) =>
+        <div key={`${item.kind}:${item.id ?? index}`}>
+              <strong>{provenanceKindLabel(item.kind)}</strong>
+              <div className="muted small-note">
+                {item.source || "i18n:govoplan-campaign.no_source.6dcf9723"}
+                {item.id && <> · <code>{item.id}</code></>}
+              </div>
+              {item.label && <p>{item.label}</p>}
+              {Object.keys(item.details ?? {}).length > 0 && <p className="muted small-note">{formatProvenanceDetails(item.details ?? {})}</p>}
+            </div>
+        )}
+        </div>
+      }
+    </>);
+}
+
+function provenanceKindLabel(kind: string): string {
+  switch (kind) {
+    case "resource":
+      return "i18n:govoplan-campaign.resource.d1c626a9";
+    case "owner":
+      return "i18n:govoplan-campaign.owner.89ff3122";
+    case "share":
+      return "i18n:govoplan-campaign.share.09ca55ca";
+    case "policy":
+      return "i18n:govoplan-campaign.policy.0b779a05";
+    case "role":
+      return "i18n:govoplan-campaign.role.b5b4a5a2";
+    case "right":
+      return "i18n:govoplan-campaign.permission.2f81a22d";
+    default:
+      return kind;
+  }
+}
+
+function formatProvenanceDetails(details: Record<string, unknown>): string {
+  return Object.entries(details).map(([key, value]) => `${key}: ${formatProvenanceValue(value)}`).join("; ");
+}
+
+function formatProvenanceValue(value: unknown): string {
+  if (value === null || value === undefined) return "i18n:govoplan-campaign.none.6eef6648";
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return String(value);
+  return JSON.stringify(value);
+}
--- a/webui/src/i18n/generatedTranslations.ts
+++ b/webui/src/i18n/generatedTranslations.ts
@@ -14,6 +14,19 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-campaign.accept_non_blocking_review_conditions.47895387": "Accept non-blocking review conditions?",
    "i18n:govoplan-campaign.accepted.61a0572c": "Accepted",
    "i18n:govoplan-campaign.access.2f81a22d": "Access",
+    "i18n:govoplan-campaign.access_explanation.75ee7f62": "Access explanation",
+    "i18n:govoplan-campaign.action.97c89a4d": "Action",
+    "i18n:govoplan-campaign.evidence.8487d192": "Evidence",
+    "i18n:govoplan-campaign.explain_access.4d5fac37": "Explain access",
+    "i18n:govoplan-campaign.loading_access_explanation.04a7c934": "Loading access explanation...",
+    "i18n:govoplan-campaign.no_access_evidence_was_returned.84a21e4e": "No access evidence was returned.",
+    "i18n:govoplan-campaign.no_source.6dcf9723": "No source",
+    "i18n:govoplan-campaign.none.6eef6648": "None",
+    "i18n:govoplan-campaign.permission.2f81a22d": "Permission",
+    "i18n:govoplan-campaign.policy.0b779a05": "Policy",
+    "i18n:govoplan-campaign.resource.d1c626a9": "Resource",
+    "i18n:govoplan-campaign.role.b5b4a5a2": "Role",
+    "i18n:govoplan-campaign.share.09ca55ca": "Share",
    "i18n:govoplan-campaign.actions.c3cd636a": "Actions",
    "i18n:govoplan-campaign.active_inline_recipients.8ba58f6e": "Active inline recipients",
    "i18n:govoplan-campaign.active.a733b809": "Active",
@@ -1128,6 +1141,19 @@ export const generatedTranslations: PlatformTranslations = {
    "i18n:govoplan-campaign.accept_non_blocking_review_conditions.47895387": "Accept non-blocking review conditions?",
    "i18n:govoplan-campaign.accepted.61a0572c": "Accepted",
    "i18n:govoplan-campaign.access.2f81a22d": "Zugriff",
+    "i18n:govoplan-campaign.access_explanation.75ee7f62": "Zugriffserklärung",
+    "i18n:govoplan-campaign.action.97c89a4d": "Aktion",
+    "i18n:govoplan-campaign.evidence.8487d192": "Nachweise",
+    "i18n:govoplan-campaign.explain_access.4d5fac37": "Zugriff erklären",
+    "i18n:govoplan-campaign.loading_access_explanation.04a7c934": "Zugriffserklärung wird geladen...",
+    "i18n:govoplan-campaign.no_access_evidence_was_returned.84a21e4e": "Es wurden keine Zugriffsnachweise zurückgegeben.",
+    "i18n:govoplan-campaign.no_source.6dcf9723": "Keine Quelle",
+    "i18n:govoplan-campaign.none.6eef6648": "Keine",
+    "i18n:govoplan-campaign.permission.2f81a22d": "Berechtigung",
+    "i18n:govoplan-campaign.policy.0b779a05": "Richtlinie",
+    "i18n:govoplan-campaign.resource.d1c626a9": "Ressource",
+    "i18n:govoplan-campaign.role.b5b4a5a2": "Rolle",
+    "i18n:govoplan-campaign.share.09ca55ca": "Freigabe",
    "i18n:govoplan-campaign.actions.c3cd636a": "Aktionen",
    "i18n:govoplan-campaign.active_inline_recipients.8ba58f6e": "Active inline recipients",
    "i18n:govoplan-campaign.active.a733b809": "Aktiv",