Skip to content

Fix <DataTable> calls useCanAccess even when bulk delete is disabled #11352

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fzaninotto merged 2 commits into from
Sep 1, 2026
+74 −0
Merged

Fix <DataTable> calls useCanAccess even when bulk delete is disabled #11352

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
470c35e
fix(datatable): skip delete access check when bulk actions are disabled
lprnmns Aug 31, 2026
f631bf9
fix(datatable): preserve auth provider access guard
lprnmns Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions packages/ra-ui-materialui/src/list/datatable/DataTable.spec.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,10 @@
import { fireEvent, render, screen, waitFor } from '@testing-library/react';
import * as React from 'react';
import {
ResourceContextProvider,
TestMemoryRouter,
type AuthProvider,
} from 'ra-core';
import {
Basic,
Columns,
Expand All @@ -12,6 +17,8 @@ import {
StandaloneDynamic,
StandaloneStatic,
} from './DataTable.stories';
import { DataTable } from './DataTable';
import { AdminContext } from '../../AdminContext';

describe('DataTable', () => {
it('should render one row per record in the list', async () => {
Expand Down Expand Up @@ -218,6 +225,39 @@ describe('DataTable', () => {
});
});
describe('bulkActionButtons', () => {
it('should not check delete permissions when bulk actions are disabled', () => {
const authProvider: AuthProvider = {
canAccess: jest.fn().mockResolvedValue(true),
checkAuth: jest.fn().mockResolvedValue(undefined),
checkError: jest.fn().mockResolvedValue(undefined),
getPermissions: jest.fn().mockResolvedValue(undefined),
login: jest.fn().mockResolvedValue(undefined),
logout: jest.fn().mockResolvedValue(undefined),
};

render(
<TestMemoryRouter>
<AdminContext authProvider={authProvider}>
<ResourceContextProvider value="books">
<DataTable
bulkActionButtons={false}
data={[{ id: 1 }]}
isPending={false}
onSelect={jest.fn()}
onToggleItem={jest.fn()}
selectedIds={[]}
total={1}
>
<DataTable.Col source="id" />
</DataTable>
</ResourceContextProvider>
</AdminContext>
</TestMemoryRouter>
);

expect(authProvider.canAccess).not.toHaveBeenCalled();
});

it('should reveal bulk delete button by default on row selection', async () => {
render(<Basic />);
const checkboxes = await screen.findAllByRole('checkbox');
Expand Down
1 change: 1 addition & 0 deletions packages/ra-ui-materialui/src/list/datatable/DataTable.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,7 @@ export const DataTable = React.forwardRef(function DataTable<
const { canAccess: canDelete } = useCanAccess({
resource: resourceFromContext,
action: 'delete',
enabled: props.bulkActionButtons !== false,

@fzaninotto fzaninotto Sep 1, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this will force enabled=true if bulk action buttons aren't explicitly disabled, which will break apps with no authProvider. Check the useCanAccess implementation: the query is only enabled if the auth provider exists.

@lprnmns lprnmns Sep 1, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in f631bf9. The enabled option is now included only when bulk actions are explicitly disabled, so useCanAccess keeps its auth-provider guard otherwise. I also added a regression test for DataTable without an auth provider; the full DataTable suite passes (29/29).

});

const {
Expand Down