Create Group Button Visibility Enhancement

Create Group Button Visibility Enhancement

Version: 0.230.030
Fixed/Implemented in version: 0.230.030

Overview

This enhancement ensures that the "Create New Group" button in the My Groups page respects the enable_group_creation setting. When group creation is disabled system-wide, the button will be hidden from all users regardless of their role permissions.

Issue Description

Previously, the "Create New Group" button visibility was only controlled by the require_member_of_create_group setting and user roles. Even when the enable_group_creation setting was disabled in Admin Settings or Control Center, users would still see the button, though they would receive an error when attempting to use it due to API-level protection.

Technical Implementation

1. Route Logic Enhancement

File: route_frontend_groups.py Function: my_groups()

Before:

# Check if user can create groups
can_create_groups = True
if require_member_of_create_group:
    can_create_groups = 'roles' in user and 'CreateGroups' in user['roles']

After:

# Check if user can create groups
can_create_groups = enable_group_creation  # First check if group creation is enabled system-wide
if can_create_groups and require_member_of_create_group:
    can_create_groups = 'roles' in user and 'CreateGroups' in user['roles']

Changes Made:

• Added enable_group_creation = settings.get("enable_group_creation", True) to retrieve the setting
• Changed logic to first check enable_group_creation before evaluating role requirements
• Role checking now only occurs when group creation is enabled system-wide

2. Version Update

File: config.py

• Incremented version from 0.230.029 to 0.230.030

Permission Matrix

The button visibility now follows this logical hierarchy:

User Experience

When enable_group_creation is disabled:

• The "Create New Group" button is completely hidden
• The create group modal is not rendered
• JavaScript event handlers for group creation are not bound
• Users cannot attempt to create groups through the UI

When enable_group_creation is enabled:

• Button visibility follows the existing role-based logic
• Users with appropriate permissions can create groups
• Users without permissions don't see the button

Consistency with Backend

This implementation ensures frontend-backend consistency:

Frontend Protection (UI Level):

• Button hidden when enable_group_creation = false
• Modal not rendered when creation is disabled
• JavaScript events not bound when creation is disabled

API Protection (Backend Level):

• @enabled_required("enable_group_creation") decorator on api_create_group endpoint
• Returns 403 Forbidden when group creation is disabled
• Prevents API access regardless of frontend state

Testing

Functional Test Coverage

The implementation includes comprehensive testing in test_create_group_button_visibility.py:

• ✅ Route Logic: Validates that the route checks enable_group_creation setting
• ✅ Template Logic: Confirms conditional button and modal display
• ✅ Permission Scenarios: Tests all combinations of settings and roles
• ✅ API Protection: Verifies backend decorator is in place
• ✅ Version Update: Confirms version increment

Test Results

📊 Results: 5/5 tests passed
✅ All Create Group button visibility tests passed!

Integration Points

Dependencies

• Requires enable_group_creation setting (added in v0.230.029)
• Uses existing can_create_groups template variable
• Leverages existing conditional template logic
• Integrates with existing role-based permission system

Related Components

• Admin Settings: Toggle to control enable_group_creation
• Control Center: "Disable Group Creation" toggle
• API Endpoints: Protected with @enabled_required decorator
• Template System: Conditional rendering based on permissions

Security Considerations

Defense in Depth

• UI Level: Button hidden when creation disabled
• API Level: Endpoint protected with decorator
• Settings Level: Admin-only control over the setting

User Experience

• Consistent Behavior: No confusing "create button that doesn't work"
• Clear Intent: When button is hidden, creation is clearly disabled
• Graceful Degradation: Existing groups continue to function normally

Backward Compatibility

• No Breaking Changes: Existing functionality preserved
• Default Behavior: enable_group_creation defaults to true
• Existing Templates: All existing template patterns continue to work
• API Compatibility: No changes to existing API contracts

Maintenance Notes

• The permission logic follows a clear hierarchy: system setting → role requirement → user role
• Template conditional logic remains unchanged, only backend variable calculation modified
• Future permission additions should follow the same pattern of system-wide then role-based checks
• The implementation leverages existing infrastructure for consistency and maintainability