feat: authorization dataset tiles

[nitrosx]

Description

Adds tile-level authorization to dataset detail page for fine-grained access control based on user group memberships.

Motivation

Enables administrators to control which user groups can view specific blocks/tiles in dataset details. Allows hiding s
ensitive metadata, creating group-specific views, and complying with data governance policies while maintaining backwa
rd compatibility.

Fixes:

• Moved authorization field in admin dashboard JSONForms schema from root level to individual customization items

Changes:

• Added authorization?: string[] to CustomizationItem interface
• Modified DatasetDetailDynamicComponent to filter tiles based on user access groups with canViewBlock() method
• Updated admin dashboard UI schema to support tile-level authorization configuration
• Added new header-5 color theme for consistent tile header styling
• Changed datasetView from static array to Observable reacting to user group changes

Tests included

• Included for each change/fix? No
• Passing? (Merge will not be approved unless this is checked) Tests need to be added

Documentation

• swagger documentation updated [required] N/A - Frontend-only feature
• official documentation updated [nice-to-have] Yes - docs/dataset-detail-block-authorization.md

official documentation info

Documentation file: docs/dataset-detail-block-authorization.md (812 lines, comprehensive)

Backend version

• Does it require a specific version of the backend? No
• which version of the backend is required: None - Frontend-only feature

AI contribution

• Changes created with Mistral Vibe
• PR message created by Mistral Vibe*

Summary by Sourcery

Introduce tile-level authorization for dataset detail tiles based on user access groups and update styling to use a new shared tile header theme.

New Features:

• Filter dataset detail tiles by user access groups using per-tile authorization metadata.
• Drive the dataset detail view from an observable so it reacts to changes in the current user's groups.
• Add a new shared tile header theme and class for consistent styling of dataset detail tiles.

Enhancements:

• Extend customization items with an optional authorization field to configure tile-level access control.
• Update admin frontend configuration schema and theme configuration to support tile-level authorization and the new header theme.

Documentation:

• Add comprehensive documentation for configuring dataset detail block/tile authorization.

[sourcery-ai]

Hey - I've left some high level feedback:

• The canViewBlock semantics for undefined vs empty authorization (defaulting to #all but treating [] as deny-all) are non-obvious; consider making this behavior explicit in the type/usage or using clearer sentinel values (e.g. ['#none']) to reduce configuration mistakes.
• Filtering sortedDatasetView in the component via datasetView$ on every userGroups$ emission couples authorization logic tightly to the UI; consider moving this filtering into a selector or a dedicated service to keep the component lean and make the logic easier to reuse and test.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `canViewBlock` semantics for undefined vs empty `authorization` (defaulting to `#all` but treating `[]` as deny-all) are non-obvious; consider making this behavior explicit in the type/usage or using clearer sentinel values (e.g. `['#none']`) to reduce configuration mistakes.
- Filtering `sortedDatasetView` in the component via `datasetView$` on every `userGroups$` emission couples authorization logic tightly to the UI; consider moving this filtering into a selector or a dedicated service to keep the component lean and make the logic easier to reuse and test.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[Junjiequan]

I left few comments, would to hear you back what you think

[nitrosx]

After a discussion with @Junjiequan , I will change the PR as follow:

• each tile can have two additional fields: visible and authorization.
  • visible: it indicates if the tile should be shown or not. it is a boolean field. If it is not present, it defaults to true, aka the tile is shown
  • authorization: it lists the groups that are able to see the tile. IT does not control access to the underlying information. Field not present, undefined, null or equal to empty array, defaults to no restrictions, everybody can see the tile. An array of names indicates the groups that are able to see the tile in the dataset custom detail view.

This solution is backward compatible with current configurations.

Regarding the lock icon, two entries in configuration will be added:

• tileRestrictedIconVisibility: will show the lock icon on tile with restricted access. Boolean. Default to False
• tileRestrictedIconGroups: list of groups that are able to see the icon. Field not present, undefined, null or equal to empty array, defaults to no restrictions, everybody can see the tile. An array of names indicates the groups that are able to see the tile in the dataset custom detail view.

Documentation and jsonForms configuration will be updated accordingly

[Copilot]

Pull request overview

Adds group-based visibility filtering and restricted-access indicators to customized dataset-detail tiles.

Changes:

• Filters tiles using user access groups and per-tile authorization.
• Adds lock indicators, configuration, and shared header styling.
• Adds end-to-end coverage and feature documentation.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/styles.scss	Registers the new header palette.
src/assets/theme.json	Defines header-5 colors.
src/assets/config.json	Adds indicator defaults.
src/app/theme.ts	Adds light-theme header colors.
src/app/state-management/models/index.ts	Extends tile configuration.
src/app/datasets/dataset-detail/dataset-detail-dynamic/dataset-detail-dynamic.component.ts	Implements authorization filtering.
src/app/datasets/dataset-detail/dataset-detail-dynamic/dataset-detail-dynamic.component.scss	Styles lock indicators.
src/app/datasets/dataset-detail/dataset-detail-dynamic/dataset-detail-dynamic.component.html	Renders filtered tiles and indicators.
src/app/datasets/dataset-detail/dataset-detail-dynamic/_dataset-detail-dynamic-theme.scss	Applies shared tile-header styling.
src/app/app-config.service.ts	Loads indicator configuration.
src/app/app-config.service.spec.ts	Updates configuration fixtures.
src/app/admin/schema/frontend.config.jsonforms.json	Adds tile authorization controls.
docs/dataset-detail-block-authorization.md	Documents the feature.
cypress/support/commands.js	Changes attachment fixture uploads.
cypress/fixtures/testData.js	Adds a test image.
cypress/e2e/datasets/datasets-detail-dynamic.cy.js	Updates dynamic-view tests.
cypress/e2e/datasets/datasets-detail-dynamic-tile-authorization.cy.js	Adds authorization scenarios.
CI/e2e/frontend.config.e2e.json	Configures authorization test tiles.

Suppressed comments (3)

docs/dataset-detail-block-authorization.md:584

• This example omits visible: false; an empty authorization array makes the block public, so the stated result is the opposite of the runtime behavior.

  "authorization": [],
  "source": "attachments"

docs/dataset-detail-block-authorization.md:628

• The implementation and new end-to-end tests allow unauthenticated users to see sections with empty or missing authorization, while this table and the note below say unauthenticated users see no blocks. Document unrestricted and restricted cases separately so deployed behavior is clear.

| Not authenticated | Any | No (requires authentication) |

docs/dataset-detail-block-authorization.md:108

• This documents global datasetDetailComponent.authorization, but the PR implements authorization only on CustomizationItem: DatasetDetailComponentConfig has no such field, the admin schema has no global authorization property, and showTile never reads one. Remove the global-authorization sections and examples (or implement the feature) so administrators are not given nonfunctional configuration.

The authorization can be configured at **two levels**:

#### Level 1: Global Dataset Detail Component Authorization (NEW)

Added to `datasetDetailComponent` object itself:

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.