Skip to content

[CSM Portal] time cards: search unscoped by default instead of forcing all-project scope - #1059

Merged
rksk merged 1 commit into
wso2-open-operations:dev-app-csm-portalfrom
rksk:csm-timecards-global-search
Jul 6, 2026
Merged

rksk merged 1 commit into
wso2-open-operations:dev-app-csm-portalfrom
rksk:csm-timecards-global-search

Conversation

@rksk

@rksk rksk commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Purpose

The three /time-cards tabs (My time sheets, All, Approvals) default filters.projectIds to every project the user can see when no project filter is picked. That was a workaround: the time-card search returned nothing without a project scope, so the UI padded every request with the full ~88-project list. That forces a large scope on every call and couples the search to the project list finishing loading.

The backing search now supports an unscoped (global) query for internal agents, so this PR makes the UI use it: with no project filter selected, send no projectIds and let the backend return the caller's full entitlement. This is an improvement to how the tabs scope their search, not a bug fix.

No tracked issue link (the umbrella item lives on a private board); the backing search change is tracked separately with the team.

Goals

  • Stop forcing an all-projects scope on the time-card tabs; search unscoped by default.
  • Keep the explicit project filter working (narrows to the chosen project(s)).
  • Keep My time sheets and Approvals correct unscoped — they are already bounded server-side by userId / approverId.

Approach

  • CsmTimeCardsPage.tsx: scopeProjectIds is now just the selected project filter (empty when none picked), instead of falling back to every visible project. baseFilters therefore omits projectIds when nothing is selected.
  • useTimeSheets.ts: the three tab queries (useMyTimeSheets, useApprovalQueue, useAllTimeCards) no longer gate enabled on !!filters?.projectIds?.length, so they run unscoped. searchTimeCards already omits projectIds from the payload when the array is empty, so no change there.
  • Updated the now-inaccurate JSDoc that said a non-empty projectIds was required.

Depends on (merge/deploy gate): the unscoped path only returns data when (1) the backing search change is live on the data source the target environment uses, and (2) the calling identity holds an internal agent role. Until both hold in a given environment, unscoped tabs would come back empty there. This is why it's a separate, reviewable change rather than folded into the earlier filter work.

User stories

  • As an internal agent, I see all time cards I'm entitled to without the UI having to enumerate every project, and a project filter still narrows the list.

Release note

Time-card tabs now search across all entitled records by default instead of requiring an all-projects scope; the project filter still narrows results.

Documentation

N/A — internal CSM portal UI, no external product documentation covers this feature.

Training

N/A — not training content.

Certification

N/A — no certification exam impact.

Marketing

N/A — internal tooling, not customer-facing marketing content.

Automation tests

  • Unit tests

    pnpm test — all csm-timecards suites pass; tsc -b clean; pnpm build clean; eslint clean on the two changed files. (Pre-existing, unrelated failures on the base branch: csm-cases/CaseActionBar.test.tsx and an eslint error in csm-operations/ChangeRequestsFilterBar.tsx — both present before this change and outside its scope.)

  • Integration tests

    Existing time-card Playwright specs are unchanged. A full live E2E run depends on the backing unscoped search being live in the target environment (see the merge/deploy gate under Approach); not re-run here.

Security checks

  • Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes
  • Ran FindSecurityBugs plugin and verified report? N/A — frontend TypeScript/React change, not a JVM component; eslint/tsc run clean on the changed files. Authorization for the unscoped path is enforced server-side (internal-agent role check), not in the client.
  • Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes

Samples

N/A

Related PRs

Follows the time-card filter/pagination work in #1055 (merged into dev-app-csm-portal).

Migrations (if applicable)

N/A — no data migration; frontend request-scoping change only.

Test environment

Node + pnpm; Vite build; Vitest unit tests. Verified locally against dev-app-csm-portal.

Learning

N/A

…g all-project scope

The three /time-cards tabs previously defaulted filters.projectIds to every
visible project when no project filter was picked, because the search returned
nothing without a project scope. The backing search now supports an unscoped
(global) query for internal agents, so drop the all-projects default: with no
project filter we send no projectIds and the backend returns the caller's full
entitlement. Picking the project filter still narrows to the chosen project(s);
My time sheets and Approvals stay bounded server-side by userId/approverId.

Also removes the projectIds-non-empty enabled-gate on the three tab queries so
they run unscoped, and updates the now-inaccurate JSDoc.
@coderabbitai

coderabbitai Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

@rksk, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 30 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 659cbbce-c6f3-4cac-a5cf-bbb70564a149

📥 Commits

Reviewing files that changed from the base of the PR and between 4eaf988 and cb5c680.

📒 Files selected for processing (2)
  • apps/csm-portal/webapp/src/features/csm-timecards/api/useTimeSheets.ts
  • apps/csm-portal/webapp/src/features/csm-timecards/pages/CsmTimeCardsPage.tsx
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@rksk
rksk merged commit 32b8f9b into wso2-open-operations:dev-app-csm-portal Jul 6, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants