fix(recommendations): thread showCheckboxes into SP-group child rows

The two buildVariantRowMarkup calls that render expanded Savings Plans
plan-type group child rows omitted the showCheckboxes argument, so it
defaulted to true. In readonly/viewer sessions (showCheckboxes === false)
the SP-group child rows rendered a checkbox cell while the column header and
non-SP rows did not, leaving the table misaligned and exposing an inert
checkbox to a role with no purchase/plan actions.

Forward showCheckboxes from the enclosing buildListMarkup scope into both
nested calls so SP-group child rows match the non-SP path and the header.

Add a regression test (readonly + admin) that expands an SP plan-type group
and asserts the child variant rows honor the role's checkbox visibility.
The readonly assertion fails before the fix and passes after.

Author: cristim

frontend/src/__tests__/recommendations-permissions.test.ts

@@ -13,7 +13,7 @@
  *   per-row checkboxes, and row-click selection are all hidden/inert.
  *   Admin and user (operator) roles are unchanged.
  */
-import { loadRecommendations } from '../recommendations';
+import { loadRecommendations, resetExpandedCells } from '../recommendations';
 import * as api from '../api';
 
 jest.mock('../api', () => ({
@@ -300,3 +300,82 @@ describe('Recommendations checkbox + row-click gating for viewer role (issue #86
     expect(summaryEffectiveCols).toBe(headerColCount);
   });
 });
+
+// Issue #135 + #869: SP plan-type group child rows must honor showCheckboxes.
+// Two SP recs of different plan types in the same (provider, account, region)
+// scope group under one SP parent row. When expanded, each per-plan-type child
+// cell renders a variant row via buildVariantRowMarkup. Those nested calls must
+// forward showCheckboxes so readonly sessions get no checkbox cells, matching
+// the non-SP path and the column header (which omits the select-all checkbox).
+describe('Recommendations SP-group child-row checkbox gating (issue #135 + #869)', () => {
+  // Two AWS savings-plans recs with distinct plan-type slugs but the same
+  // scope -> two cell keys -> one SP group with 2 plan types.
+  const spRecCompute = {
+    ...sampleRec,
+    id: 'sp1',
+    service: 'savings-plans-compute',
+    resource_type: 'compute',
+    savings: 300,
+  };
+  const spRecEc2 = {
+    ...sampleRec,
+    id: 'sp2',
+    service: 'savings-plans-ec2instance',
+    resource_type: 'ec2instance',
+    savings: 250,
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    // expandedSpGroups is module-level state; reset so the SP group starts
+    // collapsed in every test and the chevron click reliably expands it.
+    resetExpandedCells();
+    setupDom();
+    (api.getRecommendations as jest.Mock).mockResolvedValue({
+      summary: {},
+      recommendations: [spRecCompute, spRecEc2],
+      regions: [],
+    });
+    (state.getVisibleRecommendations as jest.Mock).mockReturnValue([spRecCompute, spRecEc2]);
+  });
+
+  const expandSpGroup = (): HTMLTableElement => {
+    const list = document.getElementById('recommendations-list');
+    const table = list?.querySelector('table') as HTMLTableElement | null;
+    expect(table).not.toBeNull();
+    const chevron = table!.querySelector<HTMLButtonElement>('.rec-sp-group-chevron');
+    expect(chevron).not.toBeNull();
+    chevron!.click();
+    return list!.querySelector('table') as HTMLTableElement;
+  };
+
+  test('readonly role: expanded SP-group child variant rows have no checkbox-col', async () => {
+    mockUser('readonly');
+    await loadRecommendations();
+    const table = expandSpGroup();
+
+    // The SP group expanded into per-plan-type child variant rows.
+    const childRows = table.querySelectorAll('tr.rec-variant-row');
+    expect(childRows.length).toBeGreaterThan(0);
+
+    // The bug this guards: child rows must not render a checkbox cell for
+    // readonly sessions (showCheckboxes must be threaded into the nested call).
+    for (const row of Array.from(childRows)) {
+      expect(row.querySelectorAll('td.checkbox-col').length).toBe(0);
+      expect(row.querySelectorAll('input[data-rec-id]').length).toBe(0);
+    }
+  });
+
+  test('admin role: expanded SP-group child variant rows retain checkbox-col', async () => {
+    mockUser('admin');
+    await loadRecommendations();
+    const table = expandSpGroup();
+
+    const childRows = table.querySelectorAll('tr.rec-variant-row');
+    expect(childRows.length).toBeGreaterThan(0);
+
+    for (const row of Array.from(childRows)) {
+      expect(row.querySelectorAll('td.checkbox-col').length).toBe(1);
+    }
+  });
+});

frontend/src/recommendations.ts

@@ -2933,7 +2933,7 @@ function buildListMarkup(
       for (const ck of childCellKeys) {
         const childVariants = groups.get(ck)!;
         if (childVariants.length === 1) {
-          rows.push(buildVariantRowMarkup(childVariants[0]!, selectedRecs, true, visibleCols));
+          rows.push(buildVariantRowMarkup(childVariants[0]!, selectedRecs, true, visibleCols, showCheckboxes));
           continue;
         }
 
@@ -2985,7 +2985,7 @@ function buildListMarkup(
         if (isCellExpanded) {
           const sortedChildVariants = sortVariantsInCell(childVariants);
           for (const v of sortedChildVariants) {
-            rows.push(buildVariantRowMarkup(v, selectedRecs, true, visibleCols));
+            rows.push(buildVariantRowMarkup(v, selectedRecs, true, visibleCols, showCheckboxes));
           }
         }
       }