Improve inaccessible content handling for To-Do List

Problem to solve

  • The To-Do List aggregates content from many groups and projects.
  • Some of these groups may require SAML authentication in order to access and/or edit the underlying data.
  • These groups can be connected to many different SAML authentication sources, each out which expires sessions at different intervals.
  • Other dashboard pages (like the Issues and MR lists) check whether any groups need to reauthenticate on page load.
  • The To-Do List is transitioning to a live-updating model where content will be fetched repeatedly without a full-page load. SAML sessions could reasonably expire after page load.

Proposal

Given a scenario where the user has a todo that requires SAML authentication, and they are not currently SAML authed, we could present one of the following experiences:

  1. They cannot know the todo exists until they have authenticated. (Current production behavior. Example)
  2. They can know the todo exists, but cannot see any information about the todo until they authenticate. (Concept)
  3. They can know the todo exists, and can see any information that is not restricted by the permission model implemented in our GraphQL API. (This is how the Vue-based To-Do List currently works. Example)

Have decided to move forward with approach 2. Since we will need to hide all the data though, that could look like this:

Screenshot_2024-11-05_at_12.34.45_PM

Related

#473762

#498315 (comment 2161422691)

Edited by Amelia Bauerly