feature: check user permissions to determine alerting path

PeterYurkovich · PeterYurkovich · commit 3d11da550e5f · 2025-11-11T18:06:44.000-05:00
diff --git a/web/src/components/Incidents/api.ts b/web/src/components/Incidents/api.ts
@@ -77,13 +77,13 @@ export const fetchDataForIncidentsAndAlerts = (
     prometheusUrlProps: {
       endpoint: PrometheusEndpoint.QUERY_RANGE,
       endTime: range.endTime,
-      namespace: '',
       query: customQuery,
       samples,
       timespan: range.duration,
     },
     basePath: getPrometheusBasePath({
       prometheus: 'cmo',
+      useTenancyPath: false,
     }),
   });
 
diff --git a/web/src/components/MetricsPage.tsx b/web/src/components/MetricsPage.tsx
@@ -675,7 +675,7 @@ export const QueryTable: FC<QueryTableProps> = ({ index, namespace, customDataso
           },
           basePath: getPrometheusBasePath({
             prometheus: 'cmo',
-            namespace,
+            useTenancyPath: namespace !== ALL_NAMESPACES_KEY,
             basePathOverride: customDatasource?.basePath,
           }),
         }),
diff --git a/web/src/components/alerting/AlertingPage.tsx b/web/src/components/alerting/AlertingPage.tsx
@@ -58,6 +58,7 @@ const namespacedPages = [
 const AlertingPage: FC = () => {
   const { t } = useTranslation(process.env.I18N_NAMESPACE);
   const dispatch = useDispatch();
+  const { useAlertsTenancy, accessCheckLoading } = useMonitoring();
 
   const [perspective] = useActivePerspective();
   const { setNamespace } = useQueryNamespace();
@@ -100,7 +101,7 @@ const AlertingPage: FC = () => {
 
   return (
     <>
-      {namespacedPages.includes(pathname) && (
+      {namespacedPages.includes(pathname) && !accessCheckLoading && useAlertsTenancy && (
         <NamespaceBar
           onNamespaceChange={(namespace) => {
             dispatch(alertingClearSelectorData(prometheus, namespace));
diff --git a/web/src/components/alerting/SilenceForm.tsx b/web/src/components/alerting/SilenceForm.tsx
@@ -1,4 +1,8 @@
-import { consoleFetchJSON, NamespaceBar } from '@openshift-console/dynamic-plugin-sdk';
+import {
+  consoleFetchJSON,
+  DocumentTitle,
+  NamespaceBar,
+} from '@openshift-console/dynamic-plugin-sdk';
 import {
   ActionGroup,
   Alert,
diff --git a/web/src/components/alerting/SilencesDetailsPage.tsx b/web/src/components/alerting/SilencesDetailsPage.tsx
@@ -1,7 +1,12 @@
 import * as _ from 'lodash-es';
 import type { FC } from 'react';
 
-import { Alert, ResourceIcon, Timestamp } from '@openshift-console/dynamic-plugin-sdk';
+import {
+  Alert,
+  DocumentTitle,
+  ResourceIcon,
+  Timestamp,
+} from '@openshift-console/dynamic-plugin-sdk';
 import {
   Breadcrumb,
   BreadcrumbItem,
diff --git a/web/src/components/dashboards/legacy/legacy-variable-dropdowns.tsx b/web/src/components/dashboards/legacy/legacy-variable-dropdowns.tsx
@@ -144,7 +144,10 @@ const LegacyDashboardsVariableDropdown: FC<VariableDropdownProps> = ({ id, name
         if (!customDataSourceName) {
           return buildPrometheusUrl({
             prometheusUrlProps: prometheusProps,
-            basePath: getPrometheusBasePath({ prometheus: 'cmo' }),
+            basePath: getPrometheusBasePath({
+              prometheus: 'cmo',
+              useTenancyPath: namespace !== ALL_NAMESPACES_KEY,
+            }),
           });
         } else if (extensionsResolved && hasExtensions) {
           const extension = extensions.find(
@@ -161,6 +164,7 @@ const LegacyDashboardsVariableDropdown: FC<VariableDropdownProps> = ({ id, name
             prometheusUrlProps: prometheusProps,
             basePath: getPrometheusBasePath({
               prometheus: 'cmo',
+              useTenancyPath: namespace !== ALL_NAMESPACES_KEY,
               basePathOverride: dataSource?.basePath,
             }),
           });
@@ -171,7 +175,7 @@ const LegacyDashboardsVariableDropdown: FC<VariableDropdownProps> = ({ id, name
         setIsError(true);
       }
     },
-    [customDataSourceName, extensions, extensionsResolved, hasExtensions],
+    [customDataSourceName, extensions, extensionsResolved, hasExtensions, namespace],
   );
 
   useEffect(() => {
diff --git a/web/src/components/dashboards/legacy/single-stat.tsx b/web/src/components/dashboards/legacy/single-stat.tsx
@@ -5,7 +5,7 @@ import { PrometheusEndpoint, PrometheusResponse } from '@openshift-console/dynam
 import { Bullseye, Title } from '@patternfly/react-core';
 
 import ErrorAlert from './error';
-import { getPrometheusBasePath, buildPrometheusUrl } from '../../utils';
+import { getPrometheusBasePath, buildPrometheusUrl, ALL_NAMESPACES_KEY } from '../../utils';
 import { usePoll } from '../../console/utils/poll-hook';
 import { useSafeFetch } from '../../console/utils/safe-fetch-hook';
 
@@ -118,10 +118,11 @@ const SingleStat: FC<Props> = ({ customDataSource, namespace, panel, pollInterva
     prometheusUrlProps: {
       endpoint: PrometheusEndpoint.QUERY,
       query,
-      namespace: namespace,
+      namespace,
     },
     basePath: getPrometheusBasePath({
       prometheus: 'cmo',
+      useTenancyPath: namespace !== ALL_NAMESPACES_KEY,
       basePathOverride: customDataSource?.basePath,
     }),
   });
diff --git a/web/src/components/dashboards/legacy/table.tsx b/web/src/components/dashboards/legacy/table.tsx
@@ -18,7 +18,7 @@ import { useState, useCallback } from 'react';
 import { useTranslation } from 'react-i18next';
 
 import ErrorAlert from './error';
-import { getPrometheusBasePath, buildPrometheusUrl } from '../../utils';
+import { getPrometheusBasePath, buildPrometheusUrl, ALL_NAMESPACES_KEY } from '../../utils';
 import { usePoll } from '../../console/utils/poll-hook';
 import { useSafeFetch } from '../../console/utils/safe-fetch-hook';
 
@@ -91,6 +91,7 @@ const Table: FC<Props> = ({ customDataSource, panel, pollInterval, queries, name
               },
               basePath: getPrometheusBasePath({
                 prometheus: 'cmo',
+                useTenancyPath: namespace !== ALL_NAMESPACES_KEY,
                 basePathOverride: customDataSource?.basePath,
               }),
             }),
diff --git a/web/src/components/hooks/useQueryNamespace.ts b/web/src/components/hooks/useQueryNamespace.ts
@@ -16,7 +16,7 @@ export const useQueryNamespace = () => {
     if (!queryNamespace) {
       setQueryNamespace(activeNamespace);
     }
-  }, [queryNamespace, activeNamespace, setActiveNamespace]);
+  }, [queryNamespace, activeNamespace, setActiveNamespace, setQueryNamespace]);
 
   return {
     namespace: queryNamespace,
diff --git a/web/src/components/metrics/promql-expression-input.tsx b/web/src/components/metrics/promql-expression-input.tsx
@@ -346,9 +346,10 @@ export const PromQLExpressionInput: FC<PromQLExpressionInputProps> = ({
     // If we are using the tenancy path, then add the namespace as a query parameter at the end of
     // the url
     const namespaceQueryParam = namespace !== ALL_NAMESPACES_KEY ? `?namespace=${namespace}` : '';
-    const url = `${getPrometheusBasePath({ namespace, prometheus })}/${
-      PrometheusEndpoint.LABEL
-    }/__name__/values${namespaceQueryParam}`;
+    const url = `${getPrometheusBasePath({
+      useTenancyPath: namespace !== ALL_NAMESPACES_KEY,
+      prometheus,
+    })}/${PrometheusEndpoint.LABEL}/__name__/values${namespaceQueryParam}`;
     safeFetch<LabelNamesResponse>(url)
       .then((response) => {
         const metrics = response?.data;
diff --git a/web/src/components/query-browser.tsx b/web/src/components/query-browser.tsx
@@ -652,7 +652,7 @@ const QueryBrowser_: FC<QueryBrowserProps> = ({
 
   const canStack = _.sumBy(graphData, 'length') <= maxStacks;
 
-  const [activeNamespace] = useActiveNamespace();
+  const [namespace] = useActiveNamespace();
 
   // If provided, `timespan` overrides any existing span setting
   useEffect(() => {
@@ -678,7 +678,7 @@ const QueryBrowser_: FC<QueryBrowserProps> = ({
   // Clear any existing series data when the namespace is changed
   useEffect(() => {
     dispatch(queryBrowserDeleteAllSeries());
-  }, [dispatch, activeNamespace]);
+  }, [dispatch, namespace]);
 
   const tick = () => {
     if (hideGraphs) {
@@ -701,15 +701,15 @@ const QueryBrowser_: FC<QueryBrowserProps> = ({
                 prometheusUrlProps: {
                   endpoint: PrometheusEndpoint.QUERY_RANGE,
                   endTime: timeRange.endTime,
-                  namespace: activeNamespace,
+                  namespace,
                   query,
                   samples: Math.ceil(samples / timeRanges.length),
                   timeout: '60s',
                   timespan: timeRange.duration - 1,
                 },
                 basePath: getPrometheusBasePath({
                   prometheus,
-                  namespace: useTenancy ? activeNamespace : '',
+                  useTenancyPath: useTenancy,
                   basePathOverride: customDataSource?.basePath,
                 }),
               }),
@@ -850,15 +850,15 @@ const QueryBrowser_: FC<QueryBrowserProps> = ({
     delay,
     endTime,
     filterLabels,
-    activeNamespace,
+    namespace,
     queriesKey,
     samples,
     span,
     lastRequestTime,
     showDisconnectedValues,
   );
 
-  useLayoutEffect(() => setUpdating(true), [endTime, activeNamespace, queriesKey, samples, span]);
+  useLayoutEffect(() => setUpdating(true), [endTime, namespace, queriesKey, samples, span]);
 
   const onSpanChange = useCallback(
     (newSpan: number) => {
diff --git a/web/src/components/utils.ts b/web/src/components/utils.ts
@@ -219,11 +219,11 @@ const getSearchParams = ({
 
 export const getPrometheusBasePath = ({
   prometheus,
-  namespace,
+  useTenancyPath,
   basePathOverride,
 }: {
   prometheus?: Prometheus;
-  namespace?: string;
+  useTenancyPath?: boolean;
   basePathOverride?: string;
 }) => {
   if (basePathOverride) {
@@ -232,7 +232,7 @@ export const getPrometheusBasePath = ({
 
   if (prometheus === 'acm') {
     return PROMETHEUS_PROXY_PATH;
-  } else if (namespace && namespace !== ALL_NAMESPACES_KEY) {
+  } else if (useTenancyPath) {
     return PROMETHEUS_TENANCY_BASE_PATH;
   } else {
     return PROMETHEUS_BASE_PATH;
diff --git a/web/src/contexts/MonitoringContext.tsx b/web/src/contexts/MonitoringContext.tsx
@@ -1,25 +1,72 @@
-import React from 'react';
+import React, { useMemo } from 'react';
 import { MonitoringPlugins, Prometheus } from '../components/utils';
 import { QueryParamProvider } from 'use-query-params';
 import { ReactRouter5Adapter } from 'use-query-params/adapters/react-router-5';
+import { useAccessReview } from '@openshift-console/dynamic-plugin-sdk';
 
 type MonitoringContextType = {
   /** Dictates which plugin this code is being run in */
   plugin: MonitoringPlugins;
   /** Dictates which prometheus instance this code should contact */
   prometheus: Prometheus;
+  /** Dictates if the user has accesss to alerts in ALL namespaces
+   *  If so, then don't show the namespace bar on alerting pages
+   */
+  useAlertsTenancy: boolean;
+  /** Dictates if the user has accesss to alerts in ALL namespaces
+   *  If so, then don't show the namespace bar on alerting pages
+   */
+  useMetricsTenancy: boolean;
+  /** Dictates if the users access is being loaded. */
+  accessCheckLoading: boolean;
 };
 
 export const MonitoringContext = React.createContext<MonitoringContextType>({
   plugin: 'monitoring-plugin',
   prometheus: 'cmo',
+  useAlertsTenancy: false,
+  useMetricsTenancy: false,
+  accessCheckLoading: true,
 });
 
-export const MonitoringProvider: React.FC<{ monitoringContext: MonitoringContextType }> = ({
-  children,
-  monitoringContext,
-}) => (
-  <MonitoringContext.Provider value={monitoringContext}>
-    <QueryParamProvider adapter={ReactRouter5Adapter}>{children}</QueryParamProvider>
-  </MonitoringContext.Provider>
-);
+export const MonitoringProvider: React.FC<{
+  monitoringContext: {
+    plugin: MonitoringPlugins;
+    prometheus: Prometheus;
+  };
+}> = ({ children, monitoringContext }) => {
+  const [allNamespaceAlertsTenancy, alertAccessCheckLoading] = useAccessReview({
+    group: 'monitoring.coreos.com',
+    resource: 'prometheusrules',
+    verb: 'get',
+    namespace: '*',
+  });
+  const [allNamespaceMeticsTenancy, metricsAccessCheckLoading] = useAccessReview({
+    group: 'monitoring.coreos.com',
+    resource: 'prometheuses/api',
+    verb: 'get',
+    name: 'k8s',
+    namespace: '*',
+  });
+
+  const monContext = useMemo(() => {
+    return {
+      ...monitoringContext,
+      useAlertsTenancy: !allNamespaceAlertsTenancy,
+      useMetricsTenancy: !allNamespaceMeticsTenancy,
+      accessCheckLoading: alertAccessCheckLoading || metricsAccessCheckLoading,
+    };
+  }, [
+    monitoringContext,
+    allNamespaceAlertsTenancy,
+    alertAccessCheckLoading,
+    allNamespaceMeticsTenancy,
+    metricsAccessCheckLoading,
+  ]);
+
+  return (
+    <MonitoringContext.Provider value={monContext}>
+      <QueryParamProvider adapter={ReactRouter5Adapter}>{children}</QueryParamProvider>
+    </MonitoringContext.Provider>
+  );
+};
diff --git a/web/src/hooks/useAlerts.ts b/web/src/hooks/useAlerts.ts
@@ -34,14 +34,15 @@ export const useAlerts = (props?: { overrideNamespace?: string }) => {
   // Retrieve external information which dictates which alerts to load and use
   const { plugin } = useMonitoring();
   const [namespace] = useActiveNamespace();
-  const { prometheus } = useMonitoring();
+  const { prometheus, useAlertsTenancy } = useMonitoring();
   const { perspective } = usePerspective();
   const overriddenNamespace = props?.overrideNamespace ? props.overrideNamespace : namespace;
 
   // Start polling for alerts, rules, and silences
   const { trigger } = useAlertsPoller({
     namespace: overriddenNamespace,
     prometheus,
+    useAlertsTenancy,
   });
 
   // Retrieve alerts, rules and silences from the store, which is populated in the poller
@@ -122,9 +123,11 @@ export const useAlerts = (props?: { overrideNamespace?: string }) => {
 const useAlertsPoller = ({
   namespace,
   prometheus,
+  useAlertsTenancy,
 }: {
   namespace?: string;
   prometheus: Prometheus;
+  useAlertsTenancy: boolean;
 }) => {
   const dispatch = useDispatch();
   const [customExtensions] =
@@ -143,7 +146,7 @@ const useAlertsPoller = ({
 
   const rulesUrl = buildPrometheusUrl({
     prometheusUrlProps: { endpoint: PrometheusEndpoint.RULES, namespace },
-    basePath: getPrometheusBasePath({ prometheus, namespace }),
+    basePath: getPrometheusBasePath({ prometheus, useTenancyPath: useAlertsTenancy }),
   });
   const silencesUrl = getAlertmanagerSilencesUrl({ prometheus, namespace });
 
diff --git a/web/src/hooks/useMonitoring.ts b/web/src/hooks/useMonitoring.ts
@@ -2,9 +2,13 @@ import { useContext } from 'react';
 import { MonitoringContext } from '../contexts/MonitoringContext';
 
 export const useMonitoring = () => {
-  const { prometheus, plugin } = useContext(MonitoringContext);
+  const { prometheus, plugin, useAlertsTenancy, useMetricsTenancy, accessCheckLoading } =
+    useContext(MonitoringContext);
   return {
     prometheus,
     plugin,
+    useAlertsTenancy,
+    useMetricsTenancy,
+    accessCheckLoading,
   };
 };

Original file line number	Diff line number	Diff line change
`@@ -16,7 +16,7 @@ export const useQueryNamespace = () => {`
`16`	`16`	`if (!queryNamespace) {`
`17`	`17`	`setQueryNamespace(activeNamespace);`
`18`	`18`	`}`
`19`		`- }, [queryNamespace, activeNamespace, setActiveNamespace]);`
	`19`	`+ }, [queryNamespace, activeNamespace, setActiveNamespace, setQueryNamespace]);`
`20`	`20`
`21`	`21`	`return {`
`22`	`22`	`namespace: queryNamespace,`