feat: UI graceful handling of restricted permissions for instance related actions [WD-18840]

[mas-who]

Done

Everything marked as "done" in the "Instances" tab of this spreadsheet

Review changes to be applied (based on discussions from other PR)

• apply project entitlement queries from images PR [X]
• adjust entitlement check functions to take resource as input instead of passing it via the hook [X]

QA

1. Run the LXD-UI:
   • On the demo server via the link posted by @webteam-app below. This is only available for PRs created by collaborators of the repo. Ask @mas-who or @edlerd for access.
   • With a local copy of this branch, build and run as described in the docs.
2. Perform the following QA steps:
   • Go through every line item in the sheet in the "instances" tab.
   • to make life a bit easier, it's probably a good idea to have the following permissions for this PR (can_view_projects on server; can_view_events on project; can_view_operations on project)

[webteam-app]

Demo

Jenkins

demos.haus

[edlerd]

Reviewed this partially. Some comments below.

I hope after merging the image permission PR this becomes smaller and easier to handle.

[edlerd]

Read through half of the files, some observations below.

[edlerd]

Thanks for the improvements!

Main question now is if we can even have the situation of viewing/creating/editing an instance and not being able to see the other resources like profiles or images. If the answer is no, some of the current changes are not needed, because the conditions will never apply.

[mas-who]

Thanks for the improvements!

Main question now is if we can even have the situation of viewing/creating/editing an instance and not being able to see the other resources like profiles or images. If the answer is no, some of the current changes are not needed, because the conditions will never apply.

We can certainly view/create/edit without permissions to see profiles/images/networks etc. It would be specific things that we can't modify on the instance. For instance creation, without profile permissions means the user would have to create an instance from scratch with no defaults. You can also create an instance without network btw.

[edlerd]

Thanks for the improvements, some more observations below. Still didn't get to read through all the code yet.

[edlerd]

Thanks, this is pretty close, some more comments below. Read through most of the files now.

[edlerd]

Finished reviewing all the files just now. Some comments below.

[mas-who]

@edlerd as discussed, the bulk action buttons are now disabled if the user does not have permission manage state for all selected instances on the list page.

[edlerd]

Thanks for fixing the bulk case. Looks all right now. Found small things in the instance edit form and some suggestions to simplify.

[edlerd]

Code LGTM, good stuff :)
Still need to do QA, but can also merge as is and improve potential QA as a next iteration to unblock other PRs.

[mas-who]

Code LGTM, good stuff :) Still need to do QA, but can also merge as is and improve potential QA as a next iteration to unblock other PRs.

There are quite a few PRs depending on this one, so I think it'd be good to merge this one now and have follow ups for QA issues.