From: Abhishek Desai <abhishek.desai1@ibm.com>
Date: Mon, 6 Jul 2026 10:42:47 +0000 (+0530)
Subject: mgr/dashboard: exclude user scope from read-only system role
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=65034ed4e8a4950eb18988d898022b6c33a40c87;p=ceph.git

mgr/dashboard: exclude user scope from read-only system role

Read-only users could see the Settings icon but were denied access
to user management pages. Remove user read permission from the
read-only role so the administration menu stays hidden.

Fixes: https://tracker.ceph.com/issues/77952
Signed-off-by: Abhishek Desai <adesai@redhat.com>
---

diff --git a/src/pybind/mgr/dashboard/services/access_control.py b/src/pybind/mgr/dashboard/services/access_control.py
index 392b3ab7999..81b0995a1e9 100644
--- a/src/pybind/mgr/dashboard/services/access_control.py
+++ b/src/pybind/mgr/dashboard/services/access_control.py
@@ -218,9 +218,9 @@ ADMIN_ROLE = Role(
 # read-only role provides read-only permission for all scopes
 READ_ONLY_ROLE = Role(
     'read-only',
-    'allows read permission for all security scope except dashboard settings and config-opt', {
+    'allows read permission for all security scope except user, dashboard settings and config-opt', {
         scope_name: [_P.READ] for scope_name in Scope.all_scopes()
-        if scope_name not in (Scope.DASHBOARD_SETTINGS, Scope.CONFIG_OPT)
+        if scope_name not in (Scope.USER, Scope.DASHBOARD_SETTINGS, Scope.CONFIG_OPT)
     })
 
 
diff --git a/src/pybind/mgr/dashboard/tests/test_access_control.py b/src/pybind/mgr/dashboard/tests/test_access_control.py
index a5f425e6db3..bd68733c1e3 100644
--- a/src/pybind/mgr/dashboard/tests/test_access_control.py
+++ b/src/pybind/mgr/dashboard/tests/test_access_control.py
@@ -156,7 +156,7 @@ class AccessControlTest(unittest.TestCase, CLICommandTestMixin):
         self.assertEqual(role['name'], 'read-only')
         self.assertEqual(
             role['description'],
-            'allows read permission for all security scope except dashboard settings and config-opt'
+            'allows read permission for all security scope except user, dashboard settings and config-opt'
         )
 
     def test_delete_system_role(self):