Skip to content

fix(RHCLOUD-48919): Fix Kessel workspace 400 error during permission loading - #5

Closed
aferd wants to merge 1 commit into
masterfrom
RHCLOUD-48919
Closed

fix(RHCLOUD-48919): Fix Kessel workspace 400 error during permission loading#5
aferd wants to merge 1 commit into
masterfrom
RHCLOUD-48919

Conversation

@aferd

@aferd aferd commented Jul 1, 2026

Copy link
Copy Markdown
Owner

Problem

As an org admin in a v2 RBAC org, the Kessel permission checks were throwing 400 validation errors:

https://console.stage.redhat.com/api/kessel/v1beta2/checkself
400 Bad Request
{
  "code": 400,
  "reason": "VALIDATOR",
  "message": "validation error: object.resource_id: must be at least 1 characters"
}

This occurred because the KesselRbacAccessProvider was passing an empty string (id: '') as the workspace resource ID before the workspace had loaded, which violated the Kessel API's validation requirement.

Solution

Changed the placeholder workspace resource ID from empty string to a valid UUID: '00000000-0000-0000-0000-000000000000'.

When the real workspace ID loads:

  1. The workspace useMemo updates (depends on defaultWorkspaceId)
  2. The useSelfAccessCheck hooks detect the resource.id change
  3. Permission checks automatically re-run with the correct workspace ID

Testing

Local testing:

  • ✅ No more 400 errors in network tab
  • ✅ Kessel permissions load correctly (canReadEvents: true)
  • ✅ App RBAC state correctly computed

Stage testing needed:

  • Verify "Configure Events" appears in left navigation for org admins
  • Verify no console errors on page load
  • Verify permissions work correctly after workspace loads

Technical Details

The useSelfAccessCheck hook from @project-kessel/react-kessel-access-check@0.5.0 watches resource.id as a dependency, so it automatically re-runs when the workspace ID changes from placeholder to real value.

Fixes RHCLOUD-48919

…loading

Fixes a 400 validation error when checking Kessel v2 permissions before
the workspace ID has loaded. Previously, an empty string '' was passed
as the workspace resource ID, which violates the Kessel API validation
(resource_id must be at least 1 character).

Now uses a placeholder UUID '00000000-0000-0000-0000-000000000000' when
the workspace hasn't loaded yet. The useSelfAccessCheck hooks automatically
re-run when the real workspace ID loads (via useMemo dependency on
defaultWorkspaceId), ensuring permissions are correctly checked once the
workspace is available.

This prevents console errors and ensures permissions load reliably in v2
RBAC orgs.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@aferd aferd closed this Jul 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant