fix: gate DQ steward UI behind capability flags and skip blocked API … - #446
Merged
Conversation
…calls Data Quality Stewards were hitting forbidden batch and jobs endpoints on page load. Add getCsaCapabilities/useCsaCapabilities as the single frontend source of truth and guard mount-time fetches, tabs, and actions accordingly.
Replace the monolithic App and capability flags with a thin router, StandardCsaApp, DqEligibilityApp, and EligibilityListPage so DQ stewards never mount batch/job effects and new CSA features stay profile-free.
This reverts commit 4b54fc8.
…ty page" This reverts commit be47fe4.
Defer eligibility tab reset in an effect and apply prettier formatting so CI passes on the minimal DQ mount-guard fix.
Replace the eight-flag capability matrix with isStandardUser, isDataQualitySteward, and canEditContactRecords so CSA stays the default and DQ remains the explicit exception.
Keep profile booleans and readable feature flags (batches, jobs, contacts) in one buildCapabilities() function so App.tsx documents intent at each gate without maintaining duplicate role matrices.
Use CAPABILITY_PROFILES as the single source of truth, add canAccessEligibilityList for both roles, rename caseworker actions to canPerformCsaActions, and group Clear Filters with search/PDQ instead of workflow buttons so DQ stewards can reset column filters.
plakkara-bc
approved these changes
Aug 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
DQ still triggered API calls on page load for batch and job endpoints that
BlockDqStewardGuarddenies (403). Tabs were hidden in the UI, but mount-time effects were not gated, causing errors on dev and unnecessary network traffic.This PR introduces a frontend capability model aligned with BL and skips mount-time fetches, tabs, and actions that DQ stewards cannot use. Backend guards are unchanged , they remain the security boundary.
What changed
getCsaCapabilities()anduseCsaCapabilities()as the single frontend source of truth for profile-gated features (batches, jobs, weekly files, contact management, DQ edit/delete)App.tsxso DQ stewards no longer call/batches,/jobs, or batch history on loadisDataQualityStewardchecksGET /contacts/:id/batches)canDqModifyRecord()to acceptcanEditContactsinstead of a raw profile booleanHow to test
/api/batchesor/api/jobson loadnpm testinfrontend/:csa-capabilitiesanddq-contacttests pass