Repository navigation
Conversation
What was broken Project managers could not load Engagement Opportunities. QA re-tested bopowfamo on October 9 and still received 401 Unauthorized when the UI requested includePrivate=true. Root cause The earlier PM-4439 change (3fbdfcb) included private opportunities for project managers, task managers, talent managers, and admin-like roles. The API explicitly permits private listings only for Administrator and Talent Manager roles. Substring matching in the UI exceeded that contract. No previous PM-4832-labelled branch, commit, or PR was found after searching fetched refs, history, and GitHub. The reviewed implementation is in dev. What was changed Match the API's exact Administrator, Talent Manager, and Topcoder Talent Manager role names, preserving case and whitespace normalization. Project and task managers now request public opportunities unless they also hold an authorized role. Document the role-check helper and preserve the API's access controls. Any added/updated tests Expand EngagementListPage.spec.tsx to 15 cases covering authorized aliases, mixed roles, project/task managers, misleading role substrings, anonymous users, and missing roles. Verify public cards render without the load error against a mock that rejects unauthorized private-list requests. Seven regression cases fail against the previous implementation; all 15 pass with the fix. yarn lint and NODE_OPTIONS=--max-old-space-size=8192 yarn run build pass after nvm use. The full yarn test:no-watch --runInBand --silent run has 384 passing suites and 22 failing suites (2660 passed tests, 18 failed). Unchanged origin/dev has the same 22 failing suites and 18 failed tests, with 2647 passing tests. The engagements subset also matches the baseline's three failing suites. These existing failures require separate test/configuration fixes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was broken
Project managers could not load Engagement Opportunities because the list request included
includePrivate=trueand received 401 Unauthorized. QA confirmed the issue still affectedbopowfamoon October 9.Root cause
The earlier PM-4439 implementation (
3fbdfcb13) added private opportunities for project managers, task managers, talent managers, and admin-like roles. Its substring-based role check disagreed with the API's explicit Administrator/Talent Manager restriction.I searched fetched local/remote refs, git history, and GitHub PRs before editing. No PM-4832-labelled previous branch, commit, or PR was found. The related implementation was reviewed in
origin/dev, which is the baseline for this freshPM-4832branch.What was changed
EngagementListPage.tsx: match the API's exactAdministrator,Talent Manager, andTopcoder Talent Managerroles after case/whitespace normalization; document the helper.EngagementListPage.spec.tsx: cover the role matrix and successful card rendering when unauthorized private requests would be rejected.QA verification after deployment: open Engagement Opportunities as
bopowfamo; the OPEN list request should omitincludePrivate=trueand load opportunities without the error banner.Any added/updated tests
Expanded the list-page suite from 2 to 15 tests: authorized aliases, mixed roles, project/task managers, misleading role substrings, anonymous users, and missing roles. Seven regression cases fail against the previous implementation; all 15 pass with the fix.
Commands run after
nvm use(Node 22.13.0):CI=true yarn test:no-watch --runInBand --runTestsByPath src/apps/engagements/src/pages/engagement-list/EngagementListPage.spec.tsx --silent: 15 passed.yarn lint: passed.NODE_OPTIONS=--max-old-space-size=8192 yarn run build: passed.CI=true yarn test:no-watch --runInBand src/apps/engagements: 15 passing suites, 3 existing failing suites; identical failures reproduced on unchangedorigin/dev.CI=true yarn test:no-watch --runInBand --silent: 384 passing suites, 22 failing suites; 2660 passing tests, 18 failed. Unchangedorigin/devhas the same 22 failing suites and 18 failed tests, with 2647 passing tests. Failure suite names and test names match exactly.git diff --check: passed.The full suite is not green: existing module-resolution and unrelated assertion failures require separate fixes. This PR adds no new failing suites or test cases.