Skip to content

Fix <DataTable> calls useCanAccess even when bulk delete is disabled - #11352

Merged
fzaninotto merged 2 commits into
marmelab:masterfrom
lprnmns:codex/fix-11346-skip-delete-access
Sep 1, 2026
Merged

Fix <DataTable> calls useCanAccess even when bulk delete is disabled#11352
fzaninotto merged 2 commits into
marmelab:masterfrom
lprnmns:codex/fix-11346-skip-delete-access

Conversation

@lprnmns

@lprnmns lprnmns commented Aug 31, 2026

Copy link
Copy Markdown

Problem

DataTable always requests delete permission, even when bulkActionButtons is explicitly false. This causes an unnecessary authProvider.canAccess call and can pass a record from an unrelated context to the permission check.

Solution

Disable the delete permission query when bulk actions are disabled. The default behavior and custom bulk action behavior remain unchanged.

How To Test

Run the DataTable unit test suite. The added test renders DataTable with bulkActionButtons={false} and verifies that the auth provider is not called.

Additional Checks

  • The PR targets master for a bugfix.
  • The PR includes unit tests.
  • The PR includes a story (not applicable: this is an internal permission-query optimization with no new visual state).
  • The documentation is up to date; no public API or usage change was introduced.

Fixes #11346

const { canAccess: canDelete } = useCanAccess({
resource: resourceFromContext,
action: 'delete',
enabled: props.bulkActionButtons !== false,

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this will force enabled=true if bulk action buttons aren't explicitly disabled, which will break apps with no authProvider. Check the useCanAccess implementation: the query is only enabled if the auth provider exists.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in f631bf9. The enabled option is now included only when bulk actions are explicitly disabled, so useCanAccess keeps its auth-provider guard otherwise. I also added a regression test for DataTable without an auth provider; the full DataTable suite passes (29/29).

@fzaninotto
fzaninotto merged commit 763296a into marmelab:master Sep 1, 2026
14 checks passed
@fzaninotto

Copy link
Copy Markdown
Member

thanks!

@fzaninotto fzaninotto added this to the 5.15.3 milestone Sep 1, 2026
@fzaninotto fzaninotto changed the title fix(datatable): skip delete access check when bulk actions are disabled Fix <DataTable> calls useCanAccess even when bulk delete is disabled Sep 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Checking permissions before rendering the buttons is unnecessary.

2 participants