List only Orbit groups the user can query on the dashboard

Jean-Gabriel Doyonrequested to merge
orbit-dashboard-groups-in-orbit-scope into master

What does this MR do and why?

The In your graph card on Your work > Orbit shows the item counts again. On GitLab.com it said "Counts are not available right now" for users who are a project member or a Guest in a top-level group with Orbit on.

  • The dashboard now lists the top-level groups that Orbit answers for: the enabled root groups from the Orbit authorization context. These are the same roots that Orbit gets in its token. Before, it listed every enabled root where the user had any access, including through one project.
  • Orbit denies graph_status for the other roots (404). The card loads the counts of all groups together, so one denied group made the card fail for every group.
  • The Overview globe and the Schema graphs now fill the height of the page on large screens. Their old heights stay the minimum.

References

  • Orbit scope: Analytics::KnowledgeGraph::AuthorizationContext#enabled_root_namespace_ids, the roots in the token for GKG.

Screenshots or screen recordings

The same local user is Reporter in gs-e2e-alpha, Developer on one project in gs-e2e-bravo, and Guest in gs-e2e-charlie.

Before After
before-overview-1920 after-overview-1920
Page at 2560x1440 Before After
Overview before-2560x1440-overview after-2560x1440-overview
Schema before-2560x1440-schema after-2560x1440-schema
Schema entity before-2560x1440-entity after-2560x1440-entity
Evidence of the bug

On GitLab.com, one user had 23 top-level groups with Orbit on in the dashboard list. graph_status returned 200 for 8 of them and 404 {"code":7,"message":"Knowledge graph request failed"} for 15. For all 15, the user is a member of a project in the group, not of the group itself.

On GDK, with the user from the screenshots:

Group User role Listed before Listed after graph_status
gs-e2e-alpha Reporter Yes Yes 200
gs-e2e-bravo Developer on gs-e2e-bravo/service only Yes No 404
gs-e2e-charlie Guest Yes No 404
Which groups the dashboard lists
User has Listed
Reporter or higher in the top-level group or a subgroup Yes
Reporter or higher through a group share Yes
A project membership only No
Guest only No
An Orbit promo-gated group without the add-on or an active trial No. When no other group is listed, Owners see the Off page with the trial state.
  • Admins see the groups of their own memberships, like other users. The admin Orbit page lists all groups.
  • A member of a subgroup only still sees the top-level group. Orbit answers graph_status for the subgroup path, not the top-level path, so the counts still fail for that user. This needs a follow-up.
Viewport height at each size

Graph height in pixels, before and after:

Size Overview Schema Schema entity
1280x800 500, 496 640, 640 640, 640
1920x1080 500, 727 640, 744 640, 722
2560x1440 500, 1087 640, 1104 640, 1082

Below the lg breakpoint the graphs keep their old height: after-800x900-overview

How to set up and validate locally

  1. In GDK, sign in as a user who is Reporter in one top-level group with Orbit on, and a member of only one project in a second top-level group with Orbit on.
  2. Go to http://127.0.0.1:3000/dashboard/orbit. On master, the In your graph card says "Counts are not available right now". On this branch, it shows the counts of the first group, and the second group is not listed.
  3. Open the Schema tab on a large screen. The map fills the height of the page.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports