Repository navigation
pages: one navigation on every page, with the caller's role baked into the served page - #274
Closed
jseifeddine wants to merge 2 commits into
Closed
jseifeddine wants to merge 2 commits into
jseifeddine wants to merge 2 commits into
Conversation
jseifeddine
force-pushed
the
feat/role-baked-pages-unified-nav
branch
2 times, most recently
from
October 13, 2026 07:04
bae624b to
4ee64c4
Compare
…sublines The sticky sidebar was sized from the viewport rather than from where it starts under the header, so at the top of the page its bottom hung off screen and the page had to be scrolled before the list could be scrolled to its end. The page is now an app shell: the header stays, and the sidebar and the entries area are two independent scroll panes that always fit the viewport. Selecting a folder scrolls the entries pane, not the page. The sidebar is a bordered panel: one pinned header band on a surface tone with the Folders label, a compact new-folder button and the filter box, then the list with hairline dividers, 46px rows and one 12px edge for every band. "host (Tenant)" names read as the host over a quieter tenant line in the entries and search tables, and a role-gate reconciliation covers API-key users. Part of sol1#254 connections: scroll only the entries pane on selection, clip the body jumpToEntriesHeader() used scrollIntoView(), which scrolls every scrollable ancestor, and a body with overflow hidden can still be scrolled by script: selecting a folder pushed the brand row and the nav off the top of the page. Scroll the entries pane to its top instead, and make the body overflow: clip, which no script can scroll. The body's border box now spans the full height so the page padding stays inside the viewport. Part of sol1#254 tests: app shell with two independent scroll panes and a clipped body (sol1#254)
…o the served page pages: bake the caller's role into the served page, version the logo The header flashed on every navigation: gated links (Sessions, Reports, Tokens, Admin) were hidden in the markup and shown after /api/me answered, the logo was revalidated on each page load, and the nav differed between pages, so switching tabs reflowed the header. Serve each page in five variants, one per role level, that differ only in a data-role-level attribute on <html>; optional auth now runs on the page routes so a logged-in request gets its variant with the navigation already right on first paint. The ETag is per variant. The logo joins scripts and stylesheets in content-addressed, immutable caching. Part of sol1#254 pages: one navigation for every page, gated by role in CSS Every page carries the same eight links in the same order, including the Credentials entry (which opens the dialog on the connections page and deep-links to it from elsewhere), with data-min-role on the gated ones instead of inline display:none. rustguac.css shows them from the data-role-level the server writes on <html>; the pages set that attribute themselves from /api/me for API-key users, whose page GET carries no credential. Admin-only controls follow the same gate, so nothing pops in after the first paint. Recordings shows "host (Tenant)" entry names as the host over a quieter tenant line. Part of sol1#254 tests: one navigation on every page, gated by data-role-level
jseifeddine
force-pushed
the
feat/role-baked-pages-unified-nav
branch
from
October 16, 2026 11:29
4ee64c4 to
5eed92c
Compare
Member
|
Merged into main as 6fbf590 thanks Jad. Looks good on our canary. Two small things on our side in e535e7f: page responses now send Vary: Cookie since the variant depends on the session, and the page routes no longer carry the WebSocket ticket store, so a ?ticket= on a page URL can't use up a single-use ticket. Also dropped my duplicate .entry-name CSS now that rustguac.css has it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds on #273 (
ux/connections-app-shell); its own change is the last commit, the compare on the fork: jseifeddine/rustguac@ba4d7fc...feat/role-baked-pages-unified-nav. The branch carries #273 until it merges intomain, so the Files tab shows it too. The connections page's navigation lives in the app-shell header from #273, which is why this is not onmainalone.Fixes #259.
Each page is served in five variants, one per role level, differing only in
data-role-levelon<html>; optional auth runs on the page routes so a logged-in request gets its variant on first paint, ETag per variant, logo content-addressed. Every page carries the same eight links withdata-min-roleon the gated ones; API-key users set the attribute from/api/me.Review note: this adds optional auth to the page routes and per-variant caching. Worth a careful read.
Testing
role_variant_writes_level_on_html_tag_only,test_version_assets_versions_the_logo.role-nav.spec.mjs(viewer, operator, admin; same link order on four pages).