UI: Non-admin users will see 500s and loading states on Databases and Events #48152
Description
Describe the problem
When visiting the "Databases" and "Events" pages of the admin UI as a user that is not part of the admin role they appear broken.
To Reproduce
- Set up secure CockroachDB cluster
- Create a normal user
CREATE USER blah WITH PASSWORD ... - Log into the Admin UI as the created user
- Navigate to either the "Databases" or "Events" page
- See error
Expected behavior
I would expect to see a banner stating that my user does not have access to the requested data.
I would also expect to see 403 responses rather than 500s.
Additional data / screenshots
The events page returns a 500.
The Databases page correctly returns a 403 but does not handle it.
Environment:
- CockroachDB version 19.2.x, V20.1.0-RC.2
Additional context
While debugging issues with a production cluster I noticed certain pages of the admin UI where not loading and 500s coming back from the server.
This lead me to believe that something was extremely wrong.
Another SRE was unable to reproduce the problem with an admin user which led us to the conclusion that non-admin users may be problematic.
Nothing is particularly dangerous but it is quite the red herring if a cluster is already misbehaving.