feat: classification banners for ABAC rooms

Merged
KE
3mo ago
+1123-5

Proposed changes (including videos or screenshots)

Adds classification banners to ABAC-managed rooms (EE, abac module): a colored strip rendered above the room header displaying US-Government-style classification markings (classification level, need-to-know compartments, releasability, etc.), driven by a JSON configuration.

image

How it works

  • Configuration — two new settings under Admin → ABAC → Settings → Classification banners (new accordion):
    • ABAC_Classification_Banners_Enabled (boolean toggle, public)
    • ABAC_Classification_Banners_Config (type: code, application/json, multiline, public) — a v1 JSON document describing attributes, value→label/color mappings and banner options. JSON syntax is validated on save via the existing code-setting pipeline; JSON-Schema/cross-field enforcement lands separately (see Further comments).
  • Engine — pure functions colocated with the component (client/views/room/ClassificationBanner/lib/): segment assembly (array order, delimiters, label prefixes, alphabetical sorting, group-collapse threshold), color resolution (values ranked most restrictive first — index 0 = highest, matching Virtru HIERARCHY convention; highest/attribute color modes), WCAG relative-luminance foreground, and a fallback banner when the room has no covered values. 19 unit tests, 100% statement coverage.
  • Rendering — ClassificationBanner component mounted via a new classificationBanner slot in RoomLayout, above the header. Renders only for ABAC-managed rooms, gated by the abac license module (+ ABAC_Enabled) and the enable toggle. The config is a public setting synced to clients, so the banner is computed client-side and updates live on config or room-attribute changes, no reload or server restart. Three styles supported: classic, segmented, edge.
  • Schema & docs — v1 JSON Schema published at ee/packages/abac/docs/classification-banners.schema.json ($id: https://rocket.chat/schemas/classification-banners/v1.json). The full reference documentation (semantics, cross-field rules, example) lives in the builder's Docs modal.
  • Builder — a standalone, GH-Pages-compatible configuration builder maintained at https://github.com/RocketChat/abac-banner-builder (published at https://rocketchat.github.io/abac-banner-builder/): live banner preview, attribute/value editors, simulated room values, warn-only cross-field linting, import/copy JSON, docs modal, light/dark themes using Fuselage tokens.

Example: a room with classification: [topsecret] and needtoknow: [ops, int] renders TOP SECRET // NTK-INT/OPS on the Top Secret orange with computed-contrast text.

Issue(s)

Steps to test or reproduce

  1. With an EE license including the abac module: Admin → ABAC → Settings, enable ABAC and, under the Classification banners accordion, enable the toggle and paste a config (use the builder — its Docs modal and "Load example" provide a reference configuration).
  2. Create a private room, assign ABAC attributes matching the config (e.g. classification: topsecret) via Admin → ABAC → Rooms.
  3. Open the room as a member: the banner renders above the header with the configured label/color. Add more values to cross a groupThreshold and the segment collapses to its multipleLabel.
  4. Rooms with no covered values render the configured fallback text/color; non-ABAC rooms render nothing.
  5. Edit the config → open clients update live.

Further comments

  • Save-time validation against the published JSON Schema + cross-field rules (exactly one drivesColor, unique ids/sources, multipleLabel with groupThreshold, bannerLabel with showLabel) is intentionally out of scope — a separate settings-validation effort will cover it. Until then the engine parses defensively (malformed config → no banner) and the builder lints the rules warn-only.
  • The config being a public setting is a deliberate tradeoff (initially it was admin-only with a server-computed banner endpoint): it makes banners fully reactive and removes an endpoint, at the cost of any logged-in user being able to read the mapping catalog. Documented in classification-banners.md.
  • The engine ranks hierarchy values most restrictive first (index 0 = highest) to match Virtru's HIERARCHY attribute convention.
    https://rocketchat.atlassian.net/browse/ABAC3-32

Summary by CodeRabbit

Summary by CodeRabbit

  • New Features

    • Added configurable classification banners for ABAC-managed rooms, controlled by new admin settings for enablement and JSON configuration.
    • Banners display above the room header with support for segmented text and automatically themed colors.

  • Documentation

    • Added a versioned JSON schema that defines the banner configuration format.

  • Validation & Quality

    • Enhanced JSON-schema validation for JSON-based settings, with tighter enforcement for banner configuration.
    • Added unit and end-to-end tests covering banner rendering and configuration validation.