feat(lightspeed): add missing permission screen for Notebooks tab

[its-mitesh-kumar]

Description

• Add permission check for lightspeed.notebooks.use on the Notebooks tab, showing a "Missing permission" screen when the user lacks access
• Add translation keys for the permission screen in all supported languages (en, de, es, fr, it, ja)

Steps to test

Add below config in app-config.yaml

lightspeed:
  aiNotebooks:
    enabled: true
    
 permission:
  enabled: true
  rbac:
    pluginsWithPermission:
      - lightspeed
      - catalog
      - scaffolder
      - permission
    admin:
      superUsers:
        - name: user:default/<username>
      users:
        - name: user:default/<username>

UI after changes

Screen.Recording.2026-03-27.at.7.mp4

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[rhdh-gh-app]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
app	workspaces/lightspeed/packages/app	none	v0.0.1
backend	workspaces/lightspeed/packages/backend	none	v0.0.32
@red-hat-developer-hub/backstage-plugin-lightspeed	workspaces/lightspeed/plugins/lightspeed	patch	v1.4.0

[rhdh-qodo-merge]

Review Summary by Qodo

Add missing permission screen for Lightspeed Notebooks tab

✨ Enhancement

Walkthroughs

Description

• Add permission check for lightspeed.notebooks.use on Notebooks tab
• Create useLightspeedNotebooksPermission hook for notebook access validation
• Create NotebookPermissionRequired component with two-column layout
• Add translation keys for permission screen in six languages
• Replace permission backend with RBAC backend for enhanced access control

Diagram

flowchart LR
  A["User accesses Notebooks tab"] --> B{"Has lightspeed.notebooks.use permission?"}
  B -->|Yes| C["Display NotebooksTab component"]
  B -->|No| D["Display NotebookPermissionRequired screen"]
  D --> E["User clicks Go back button"]
  E --> F["Return to Chat tab"]

Loading

File Changes

1. workspaces/lightspeed/plugins/lightspeed/src/hooks/useLightspeedNotebooksPermission.ts ✨ Enhancement +30/-0

New hook for notebooks permission validation

workspaces/lightspeed/plugins/lightspeed/src/hooks/useLightspeedNotebooksPermission.ts

---

2. workspaces/lightspeed/plugins/lightspeed/src/hooks/index.ts ✨ Enhancement +1/-0

Export new notebooks permission hook

workspaces/lightspeed/plugins/lightspeed/src/hooks/index.ts

---

3. workspaces/lightspeed/plugins/lightspeed/src/components/NotebookPermissionRequired.tsx ✨ Enhancement +102/-0

New permission required screen component

workspaces/lightspeed/plugins/lightspeed/src/components/NotebookPermissionRequired.tsx

---

View more (15)

4. workspaces/lightspeed/plugins/lightspeed/src/components/LightSpeedChat.tsx ✨ Enhancement +24/-13

Integrate permission check for notebooks tab

workspaces/lightspeed/plugins/lightspeed/src/components/LightSpeedChat.tsx

---

5. workspaces/lightspeed/plugins/lightspeed/src/translations/ref.ts 📝 Documentation +4/-0

Add English translation keys for notebooks permission

workspaces/lightspeed/plugins/lightspeed/src/translations/ref.ts

---

6. workspaces/lightspeed/plugins/lightspeed/src/translations/de.ts 📝 Documentation +4/-0

Add German translation keys for notebooks permission

workspaces/lightspeed/plugins/lightspeed/src/translations/de.ts

---

7. workspaces/lightspeed/plugins/lightspeed/src/translations/es.ts 📝 Documentation +4/-0

Add Spanish translation keys for notebooks permission

workspaces/lightspeed/plugins/lightspeed/src/translations/es.ts

---

8. workspaces/lightspeed/plugins/lightspeed/src/translations/fr.ts 📝 Documentation +4/-0

Add French translation keys for notebooks permission

workspaces/lightspeed/plugins/lightspeed/src/translations/fr.ts

---

9. workspaces/lightspeed/plugins/lightspeed/src/translations/it.ts 📝 Documentation +4/-0

Add Italian translation keys for notebooks permission

workspaces/lightspeed/plugins/lightspeed/src/translations/it.ts

---

10. workspaces/lightspeed/plugins/lightspeed/src/translations/ja.ts 📝 Documentation +4/-0

Add Japanese translation keys for notebooks permission

workspaces/lightspeed/plugins/lightspeed/src/translations/ja.ts

---

11. workspaces/lightspeed/plugins/lightspeed/report-alpha.api.md 📝 Documentation +3/-0

Update API documentation with new translation keys

workspaces/lightspeed/plugins/lightspeed/report-alpha.api.md

---

12. workspaces/lightspeed/packages/backend/src/index.ts ⚙️ Configuration changes +2/-6

Replace permission backend with RBAC backend

workspaces/lightspeed/packages/backend/src/index.ts

---

13. workspaces/lightspeed/packages/backend/package.json Dependencies +1/-0

Add RBAC backend dependency

workspaces/lightspeed/packages/backend/package.json

---

14. workspaces/lightspeed/packages/app/package.json Dependencies +1/-0

Add RBAC frontend dependency

workspaces/lightspeed/packages/app/package.json

---

15. workspaces/lightspeed/packages/app/src/App.tsx ✨ Enhancement +2/-0

Add RBAC page route to application

workspaces/lightspeed/packages/app/src/App.tsx

---

16. workspaces/lightspeed/packages/app/src/components/Root/Root.tsx ✨ Enhancement +2/-0

Add RBAC administration sidebar component

workspaces/lightspeed/packages/app/src/components/Root/Root.tsx

---

17. workspaces/lightspeed/package.json Dependencies +3/-1

Add backend API version resolutions

workspaces/lightspeed/package.json

---

18. workspaces/lightspeed/.changeset/strange-peaches-confess.md 📝 Documentation +5/-0

Document permission screen feature addition

workspaces/lightspeed/.changeset/strange-peaches-confess.md

---

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📎 Requirement gaps (0) 📐 Spec deviations (0)

1. Unauthorized notebooks fetches 🐞 Bug ⛯ Reliability

Description

LightspeedChat still enables/refetches notebook sessions whenever the Notebooks tab is selected,
even when useLightspeedNotebooksPermission denies access, so the frontend will continue making
notebooks API calls that the backend rejects as "Permission denied". This causes unnecessary 403
traffic and react-query errors even though the UI shows the permission-required screen.

Code

workspaces/lightspeed/plugins/lightspeed/src/components/LightSpeedChat.tsx[R468-469]

+  const { allowed: hasNotebooksAccess, loading: notebooksPermissionLoading } =
+    useLightspeedNotebooksPermission();

Evidence

The UI permission check was added, but notebook session fetching is still driven solely by the
selected tab (not by hasNotebooksAccess). The notebooks backend explicitly enforces
lightspeedNotebooksUsePermission, so denied users will receive permission-denied responses for
those requests.

workspaces/lightspeed/plugins/lightspeed/src/components/LightSpeedChat.tsx[362-409]
workspaces/lightspeed/plugins/lightspeed/src/components/LightSpeedChat.tsx[466-469]
workspaces/lightspeed/plugins/lightspeed/src/components/LightSpeedChat.tsx[1225-1244]
workspaces/lightspeed/plugins/lightspeed/src/hooks/useNotebookSessions.ts[24-36]
workspaces/lightspeed/plugins/lightspeed-backend/src/service/notebooks/notebooksRouters.ts[98-113]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The Notebooks tab permission check currently only affects rendering; the notebooks sessions query is still enabled/refetched based on tab selection alone. This results in unnecessary unauthorized calls (and react-query errors) when the user lacks `lightspeed.notebooks.use`.

## Issue Context
Backend notebook routes enforce `lightspeedNotebooksUsePermission`, so requests from denied users will be rejected.

## Fix Focus Areas
- workspaces/lightspeed/plugins/lightspeed/src/components/LightSpeedChat.tsx[362-409]
- workspaces/lightspeed/plugins/lightspeed/src/components/LightSpeedChat.tsx[466-469]

## Suggested fix
- Compute notebooks permission first, then set the query `enabled` flag to something like `activeTab === 1 && hasNotebooksAccess && !notebooksPermissionLoading`.
- Guard `refetchNotebooks()` in `handleNotebookTabSelect` so it only runs when permission is allowed (and not loading).
- Optionally reset/suppress notebook-query error state when permission is denied to avoid background error noise.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Stale permission backend deps 🐞 Bug ⚙ Maintainability

Description

The backend is switched to @backstage-community/plugin-rbac-backend, but
@backstage/plugin-permission-backend and the allow-all policy packages remain declared even though
they are no longer added in backend/src/index.ts. This leaves unused dependencies and obscures
which permission backend is actually in use.

Code

workspaces/lightspeed/packages/backend/package.json[R24-27]

+    "@backstage-community/plugin-rbac-backend": "5.2.6",
    "@backstage/backend-defaults": "^0.15.1",
    "@backstage/config": "^1.3.6",
    "@backstage/plugin-app-backend": "^0.5.10",

Evidence

backend/src/index.ts no longer registers the permission backend and allow-all policy modules, but
the backend package still declares them as dependencies alongside the newly added RBAC backend
package.

workspaces/lightspeed/packages/backend/src/index.ts[41-43]
workspaces/lightspeed/packages/backend/package.json[23-40]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
After switching to `@backstage-community/plugin-rbac-backend`, the backend workspace still lists the old permission backend packages that are no longer registered. This is dead weight and creates ambiguity.

## Issue Context
`backend/src/index.ts` now adds only the RBAC backend; it no longer adds `@backstage/plugin-permission-backend` or the allow-all policy module.

## Fix Focus Areas
- workspaces/lightspeed/packages/backend/package.json[23-40]
- workspaces/lightspeed/packages/backend/src/index.ts[41-43]

## Suggested fix
- Remove unused dependencies from `workspaces/lightspeed/packages/backend/package.json`:
 - `@backstage/plugin-permission-backend`
 - `@backstage/plugin-permission-backend-module-allow-all-policy`
- If any are still needed transitively for types/helpers, document why (otherwise prefer removing).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ The new review experience is currently in Beta. Learn more

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud