feat: user project access management by irfanuddinahmad · Pull Request #16 · arbisoft/incubator-devlake

irfanuddinahmad · 2026-03-12T09:34:47Z

This pull request introduces a new feature for managing per-user project visibility in Grafana dashboards by adding a user-project mapping table and related API endpoints. It also includes updates to the release workflow and Grafana dashboard setup. The most important changes are grouped below:

User-Project Mapping Feature

Added UserProjectMapping model to map Grafana user logins to DevLake project names, enabling per-user project visibility. (backend/core/models/project.go)
Introduced a database migration to create the user_project_mapping table. (backend/core/models/migrationscripts/20260311_add_user_project_mapping.go)
Registered the migration script in the migration pipeline. (backend/core/models/migrationscripts/register.go)
Implemented user-project mapping API endpoints for CRUD operations and integrated them into the router. (backend/server/api/user_project_mapping/user_project_mapping.go, backend/server/api/router.go) [1] [2] [3]
Added backend service functions to support user-project mapping operations. (backend/server/services/user_project_mapping.go)

Release Workflow Improvements

Created .github/workflows/release-images.yml for automated building and publishing of Docker images for backend, config UI, and Grafana dashboard on tag pushes.

Grafana Dashboard Enhancement

Updated grafana/Dockerfile to install the volkovlabs-form-panel plugin, expanding dashboard capabilities.

- Add Grafana admin dashboard (Business Forms v6) for managing user-project mappings (add/remove) via DevLake REST API - Install volkovlabs-form-panel in Grafana Docker image - Add user_project_mapping DB table, migration, service and API handlers - Register user-project-mapping routes in server router - Rename devlake_project variable to project in all DORA dashboards (project filter now queries user_project_mapping for the logged-in user) - Add GitHub Actions workflow for building and pushing release images

…hboards

Copilot

Pull request overview

This PR adds a per-user project visibility mechanism for Grafana dashboards by introducing a user_project_mapping table and CRUD API endpoints, then wiring Grafana dashboards to filter the $project variable based on the logged-in user.

Changes:

Added user_project_mapping model + DB migration and registered it in the migration pipeline.
Added backend service + API handlers + router wiring for user↔project mapping CRUD.
Updated Grafana dashboards and provisioning to use user-specific project lists and added an admin dashboard for managing mappings; updated Grafana image/plugins and added a release workflow.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
grafana/provisioning/dashboards/dashboard.yml	Enables UI updates for provisioned dashboards (impacts how access controls can be enforced).
grafana/dashboards/admin/AdminUserProjectAccess.json	New admin dashboard for adding/removing user-project mappings via API.
grafana/dashboards/DORADetails-TimetoRestoreService.json	Filters project variable via `user_project_mapping` and updates SQL variable interpolation.
grafana/dashboards/DORADetails-LeadTimeforChanges.json	Filters project variable via `user_project_mapping` and updates SQL variable interpolation.
grafana/dashboards/DORADetails-FailedDeploymentRecoveryTime.json	Filters project variable via `user_project_mapping` and updates SQL variable interpolation.
grafana/dashboards/DORADetails-DeploymentFrequency.json	Filters project variable via `user_project_mapping` and updates SQL variable interpolation.
grafana/dashboards/DORADetails-ChangeFailureRate.json	Filters project variable via `user_project_mapping` and updates SQL variable interpolation.
grafana/dashboards/DORADebug.json	Filters project variable via `user_project_mapping` and updates SQL variable interpolation for debugging panels.
grafana/dashboards/DORAByTeam.json	Adds a project template variable sourced from `user_project_mapping`.
grafana/dashboards/DORA.json	Filters project variable via `user_project_mapping` and updates SQL variable interpolation.
grafana/Dockerfile	Installs `volkovlabs-form-panel` plugin in the Grafana image.
backend/server/services/user_project_mapping.go	Adds service-layer CRUD helpers for user-project mappings.
backend/server/api/user_project_mapping/user_project_mapping.go	Adds HTTP endpoints for listing/creating/deleting mappings.
backend/server/api/router.go	Registers the new user-project-mappings routes.
backend/core/models/project.go	Adds `models.UserProjectMapping` GORM model.
backend/core/models/migrationscripts/register.go	Registers the new migration script.
backend/core/models/migrationscripts/20260311_add_user_project_mapping.go	Adds migration to create `user_project_mapping` table.
.github/workflows/release-images.yml	Adds a tag-triggered image build/push workflow (currently duplicates existing release workflow).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-12T10:06:30Z

+        "update": {
+          "method": "POST",
+          "url": "https://aperture.arbisoft.com/api/user-project-mappings/${userLogin}",
+          "header": [
+            {
+              "name": "Content-Type",
+              "value": "application/json"
+            }
+          ],


The form panel uses a hard-coded absolute DevLake API URL. This makes the dashboard non-portable across environments and can break in deployments where Grafana reaches DevLake via a different host/path (or needs to go through Grafana’s proxy to avoid CORS). Consider using a relative URL (e.g., pointing at the same origin) or a configurable dashboard variable for the DevLake base URL instead of embedding https://aperture.arbisoft.com in the JSON.

Copilot · 2026-03-12T10:06:31Z

+func GetAllMappings(c *gin.Context) {
+	mappings, err := services.GetAllUserProjectMappings()
+	if err != nil {
+		shared.ApiOutputError(c, errors.Default.Wrap(err, "error getting user project mappings"))
+		return
+	}
+	shared.ApiOutputSuccess(c, mappings, http.StatusOK)
+}


This endpoint returns the full user→project access list, but there’s no authorization/permission check at the handler level. Since these mappings are used to enforce per-user dashboard visibility, exposing the complete mapping table to any authenticated caller can leak which projects other users have access to. Consider restricting this route to an admin-only path / API-key-protected access, or otherwise enforcing that only privileged users can call it.

Copilot · 2026-03-12T10:06:31Z

+func PostMapping(c *gin.Context) {
+	userLogin := c.Param("userLogin")
+	var body struct {
+		ProjectName string `json:"projectName" binding:"required"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		shared.ApiOutputError(c, errors.BadInput.Wrap(err, shared.BadRequestBody))
+		return
+	}
+	mapping := &models.UserProjectMapping{
+		UserLogin:   userLogin,
+		ProjectName: body.ProjectName,
+	}
+	if err := services.CreateUserProjectMapping(mapping); err != nil {
+		shared.ApiOutputError(c, errors.Default.Wrap(err, "error creating user project mapping"))
+		return
+	}
+	shared.ApiOutputSuccess(c, mapping, http.StatusCreated)


PostMapping allows creating a mapping for any :userLogin provided in the path, without verifying the caller is authorized to modify that user’s access. That means a non-admin user could grant themselves (or others) access to additional projects and bypass the intended per-user visibility control. Consider adding an authorization check (e.g., require an admin identity / API key scope for managing other users, and/or only allow self-service updates when userLogin matches the authenticated user).

Copilot · 2026-03-12T10:06:31Z

+  push:
+    tags:
+      - 'v*'
+


This workflow duplicates the existing .github/workflows/release.yml (same name/trigger/jobs). As-is, tag pushes will run two nearly identical workflows, doubling CI time and potentially racing to push the same image tags. Consider removing one of them, or changing the trigger/name/tags so only a single release-image workflow runs per tag.

Suggested change

push:

tags:

- 'v*'

workflow_call:

Copilot · 2026-03-12T10:06:32Z

  updateIntervalSeconds: 5
  # <bool> allow updating provisioned dashboards from the UI
-  allowUiUpdates: false
+  allowUiUpdates: true


allowUiUpdates: true allows users to modify provisioned dashboards via the Grafana UI and have those changes persisted in Grafana’s DB. For this PR’s per-user project visibility to be meaningful, dashboards/variables shouldn’t be user-editable (otherwise a user can alter the project variable query and bypass visibility restrictions). Consider keeping allowUiUpdates: false (or locking down dashboard edit permissions at the Grafana org/folder level) and provisioning changes via Git instead.

Suggested change

allowUiUpdates: true

allowUiUpdates: false

…flows

…hboards

…yle breakdown)

…user_accounts join

…tio)

…metrics per developer

…b score

irfanuddinahmad added 3 commits March 12, 2026 14:11

fix: rename devlake_project variable to project in remaining DORA das…

42f0499

…hboards

fix: remove undefined modifyCicdDeploymentsToText from register.go

9a30ef9

irfanuddinahmad force-pushed the feat/user-project-access-management branch from 002fe40 to 9a30ef9 Compare March 12, 2026 09:40

fix: enable allowUiUpdates in Grafana dashboard provisioning

e2f18cd

jawad-khan requested a review from Copilot March 12, 2026 10:00

irfanuddinahmad changed the title ~~Feat/user project access management~~ feat: user project access management Mar 12, 2026

Copilot started reviewing on behalf of jawad-khan March 12, 2026 10:01 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

irfanuddinahmad force-pushed the feat/user-project-access-management branch from e2f18cd to b722fab Compare March 12, 2026 10:10

fix: use DOCKER_USERNAME secret for image tags in release workflow

e088eab

irfanuddinahmad force-pushed the feat/user-project-access-management branch 2 times, most recently from e088eab to 05a56f5 Compare March 12, 2026 11:14

fix: replace hardcoded jawad4khan with DOCKER_USERNAME secret in work…

895af70

…flows

irfanuddinahmad force-pushed the feat/user-project-access-management branch 2 times, most recently from 895af70 to 84acd99 Compare March 12, 2026 11:29

fix: remove v* tag trigger from build.yml (uses unset Apache secrets)

efc0efa

irfanuddinahmad force-pushed the feat/user-project-access-management branch from a289d82 to efc0efa Compare March 12, 2026 11:37

irfanuddinahmad added 12 commits March 12, 2026 19:44

fix: filter project dropdown by user_project_mapping in remaining das…

d1c58b2

…hboards

fix: filter repo_id and board_id by user's accessible projects

fe188ab

feat: add In Testing and Ready for Testing charts to Jirav2 dashboard

262b8fa

feat: add Developer Scorecard dashboard (composite scoring + radar-st…

aec983a

…yle breakdown)

fix: scorecard - add variable regex for name--id parsing, drop empty …

ad76adc

…user_accounts join

feat: scorecard - add fuzzy identity merging (SOUNDEX + 80% length ra…

32888f3

…tio)

fix: PR code review table - add title to GROUP BY, use $__timeFilter

c58a034

fix: PR cycle time table - add title to GROUP BY, use $__timeFilter

be63353

feat: scorecard - split GitHub/Jira leaderboards, add PR code review …

f157b22

…metrics per developer

fix: Jira leaderboard panel datasource reference

b9a6ea7

docs: update scorecard dashboard introduction

369f9f2

feat: add Avg Review Depth to GitHub Score formula

47b2659

irfanuddinahmad added 4 commits March 19, 2026 21:41

fix: increase intro panel height to 10 rows

e3935f8

feat: remove Jira Score from Jira leaderboard

13779c8

fix: remove blockquote from fuzzy matching note in intro

5318ae4

feat: add Review Comments column and penalize PRs w/o Review in GitHu…

861a830

…b score

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: user project access management#16

feat: user project access management#16
irfanuddinahmad wants to merge 23 commits intoarbisoft:productionfrom
irfanuddinahmad:feat/user-project-access-management

irfanuddinahmad commented Mar 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-  push:
-    tags:
-      - 'v*'
+  workflow_call:

Conversation

irfanuddinahmad commented Mar 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants