Ensure lists for resources that don't have schema attributes.verbs LIST aren't shown by richard-cox · Pull Request #16398 · rancher/dashboard

richard-cox · 2026-01-20T09:25:27Z

Summary

Fixes #15453

Occurred changes and/or fixed issues

some resources cannot be listed, for example
- "ext.cattle.io.passwordchangerequest",
- "authorization.k8s.io.subjectaccessreview",
- "authorization.k8s.io.selfsubjectrulesreview",
- "authorization.k8s.io.selfsubjectaccessreview",
- "binding",
- "authentication.k8s.io.tokenreview",
- "ext.cattle.io.groupmembershiprefreshrequest",
- "authentication.k8s.io.selfsubjectreview",
- "authorization.k8s.io.localsubjectaccessreview",
- "ext.cattle.io.selfuser"
Navigating directly to these resources via url (Example /c/local/explorer/authentication.k8s.io.selfsubjectreview)
- Previously - showed an empty list with forever loading indicator
- Now - show an error
Navigating via the side nav
- No change (this happens anyway given they have a count of zero)
Navigating via the resource search modal
- Before - these were shown and user could click
- Now - these are not shown
In order to support the ResourceList beforeMount AND fetch in a component with mixins that do NOT contain beforeMount i had to update fetch.client (which overwrites beforeMount if fetch is there)

Areas or cases that should be tested

User cannot see resources that cannot be listed in the side bar
User cannot see resources that cannot be listed in the cluster explorer resource search
When navigating directly to a list that shows resources that cannot be listed we show an appropriate message
- Example /c/local/explorer/authentication.k8s.io.selfsubjectreview

Areas which could experience regressions

spoofed resource lists should show
- Users & Authentication - Groups
- Cluster --> Logging --> Filters
Lists that have custom components continue to load results
- cluster explorer --> Workload types
- cluster management --> clusters
Lists that have no custom components continue to load results
- cluster explorer --> more resources --> authentication providers
- cluster management --> advanced --> machine deployments

Checklist

The PR is linked to an issue and the linked issue has a Milestone, or no issue is needed
The PR has a Milestone
The PR template has been filled out
The PR has been self reviewed
The PR has a reviewer assigned
The PR has automated tests or clear instructions for manual tests and the linked issue has appropriate QA labels, or tests are not needed
The PR has reviewed with UX and tested in light and dark mode, or there are no UX changes
The PR has been reviewed in terms of Accessibility
The PR has considered, and if applicable tested with, the three Global Roles Admin, Standard User and User Base

richard-cox · 2026-01-21T16:19:43Z

shell/mixins/fetch.client.js

@@ -5,6 +5,12 @@ const hasFetch = (component) => component.$options && typeof component.$options.
 export const addLifecycleHook = (vm, hook, fn) => {
  if (!vm.$options[hook]) {
    vm.$options[hook] = [];
+  } else if (!Array.isArray(vm.$options[hook]) && typeof vm.$options[hook] === 'function' ) {


without this the fetch would not run in components with beforeMount and mixins which had no beforeMounts

richard-cox · 2026-01-26T15:43:48Z

shell/store/type-map.js

+
+      const verbs = schema.attributes?.verbs || [];
+
+      if ( !verbs.includes('list') ) {


Spoofed lists should always have LIST permissions

codyrancher

In the future should we be checking for the get verb or using canList in all the places we're doing permissions with schemaFor?

richard-cox · 2026-02-12T14:38:25Z

@codyrancher exactly that. before we just checked if the schema was accessible then assumed all get/list was allowed. going forward we should use the new canGet and updated canList getters. I recently updated the pr with the canGet to solve an issue with the user activity stuff (we were trying to canList a resource which only supported Get), so worth another quick review

…ST aren't shown

- an alternative was to disable the navigation, however that would involve changes to the same component that handles the side bar

- user activity was broken given - we were calling canList on an unlistable resource - fixed by creating a new canGet store store getter - we were using canList on a norman schema, which used the new steve specific check for attributes - fixed by having norman specific canList - changes - move canList and create new canGet in root store - their functionality should be the same as before - point canList and new canGet to model getters - add root canList and canGet that behaved as before - add steve specific canList and canGet that looks at attribute verbs

richard-cox · 2026-02-13T17:17:33Z

Note to self, this requires squash merging

codyrancher · 2026-02-13T17:32:40Z

Note to self, this requires squash merging

Squash with just the ascii art commit message

richard-cox added this to the v2.14.0 milestone Jan 20, 2026

richard-cox self-assigned this Jan 20, 2026

richard-cox force-pushed the fix-unlistable-lists branch 2 times, most recently from c729fa5 to 44a8a69 Compare January 21, 2026 16:18

richard-cox commented Jan 21, 2026

View reviewed changes

richard-cox commented Jan 26, 2026

View reviewed changes

richard-cox force-pushed the fix-unlistable-lists branch from 44a8a69 to af26fe5 Compare January 26, 2026 15:58

richard-cox marked this pull request as ready for review January 26, 2026 15:59

richard-cox requested a review from codyrancher January 26, 2026 15:59

codyrancher previously approved these changes Jan 29, 2026

View reviewed changes

richard-cox force-pushed the fix-unlistable-lists branch 2 times, most recently from 0056df7 to 8ec2117 Compare February 6, 2026 15:02

richard-cox dismissed codyrancher’s stale review via c4fb6bd February 9, 2026 16:00

richard-cox force-pushed the fix-unlistable-lists branch 2 times, most recently from f712dea to 4724de1 Compare February 12, 2026 14:36

richard-cox requested a review from codyrancher February 12, 2026 14:40

codyrancher previously approved these changes Feb 12, 2026

View reviewed changes

richard-cox added 6 commits February 13, 2026 16:07

Ensure lists for resources that don't have schema attributes.verbs LI…

1b4c996

…ST aren't shown

Hide resources in the Resource Search modal that cannot be navigated to

1c96ee9

- an alternative was to disable the navigation, however that would involve changes to the same component that handles the side bar

Handle case where components with mixins have hook fn instead of arrays

93bb21c

Fix e2e test

5a65e01

Improvements

ac32e2d

richard-cox force-pushed the fix-unlistable-lists branch from 4724de1 to ac32e2d Compare February 13, 2026 16:08

Another attempt at fixing an e2e test...

4f85a1a

richard-cox dismissed codyrancher’s stale review via 4f85a1a February 13, 2026 16:47

(╯°□°）╯︵ ┻━┻

8ac33e8

codyrancher self-requested a review February 13, 2026 21:28

codyrancher approved these changes Feb 13, 2026

View reviewed changes

richard-cox merged commit f78e32e into rancher:master Feb 16, 2026
37 checks passed

richard-cox deleted the fix-unlistable-lists branch February 16, 2026 08:50

a110605 mentioned this pull request Mar 3, 2026

Undefined error when visiting list page in harvester ui extension using shell 3.0.9-rc.5 #16818

Closed

richard-cox mentioned this pull request Mar 3, 2026

Only check if resource is listable if there's not a custom list component #16819

Merged

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Ensure lists for resources that don't have schema attributes.verbs LIST aren't shown#16398

Ensure lists for resources that don't have schema attributes.verbs LIST aren't shown#16398
richard-cox merged 8 commits intorancher:masterfrom
richard-cox:fix-unlistable-lists

richard-cox commented Jan 20, 2026 •

edited

Loading

Uh oh!

richard-cox Jan 21, 2026

Uh oh!

richard-cox Jan 26, 2026

Uh oh!

codyrancher left a comment

Uh oh!

richard-cox commented Feb 12, 2026

Uh oh!

richard-cox commented Feb 13, 2026

Uh oh!

codyrancher commented Feb 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		const verbs = schema.attributes?.verbs \|\| [];

		if ( !verbs.includes('list') ) {

Conversation

richard-cox commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Occurred changes and/or fixed issues

Areas or cases that should be tested

Areas which could experience regressions

Checklist

Uh oh!

richard-cox Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

richard-cox Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

codyrancher left a comment

Choose a reason for hiding this comment

Uh oh!

richard-cox commented Feb 12, 2026

Uh oh!

richard-cox commented Feb 13, 2026

Uh oh!

codyrancher commented Feb 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

richard-cox commented Jan 20, 2026 •

edited

Loading