Operators edit other organization projects tasks

Task 9214 · Done · Coder · created · updated

Operators must be able to change anything in a tenant org, acting on its behalf (operator decision in Task 9182). Credentials and the Accounts enable toggle already do this: the page stays editable, says "Changes are made as <Org>." and every write carries the one-request act-as header (`actAsOnce`, apps/web/src/lib/actAs.ts; ADR-0161). These pages still lock another org's row behind `OtherOrgNotice`: - Project edit page (apps/web/src/pages/ProjectEditPage.tsx): every tab's writes go as the project's org; drop the lock for operators. - Task detail and row actions (TaskDetailPage, useTaskDetailAccess, useTaskAccess, components/tasks/rowActions.tsx): every panel's write goes as the task's org; the board's predicates stop treating another org's task as read-only for operators. - Account edit page (apps/web/src/pages/credentials/AccountEditPage.tsx): Edit enabled, saves go as the account's org. - Remove `OtherOrgNotice` once nothing uses it. Out of scope: API authz (the server already accepts act-as writes); tenant Org Admin permissions; runner credential use. Done means: - An operator viewing another org's project, task and account can save changes; each write request carries `X-Jaah-Act-As: <row org>` (vitest per page). - The audit row of such a write carries `acting_as`. - No page renders `OtherOrgNotice` for an operator.

Outcome

Operators now edit another org's project, task, board rows and account in place. Each write goes as the row's org (X-Jaah-Act-As) and its audit row records acting_as. OtherOrgNotice removed. Quick gate green, review lanes pass. PR #6709 merged (18a4daee1), deploy succeeded. Follow-up draft #9221. Memory: used mem-15203, mem-14612; proposed none.

Pull request

Artifacts

Activity

  • Created
  • Run
  • Runner started
  • Runner ended (done)