Permissions handling in views

Airplane Views execute tasks (e.g. manually executed or in a task-backed component) according to the permissions of the current user. This means that views often don't need any additional permissions, provided that:

Tasks are treated differently depending on whether they are queries or mutations. Queries simply return data without producing side effects, and are the tasks passed as input to components like Table and Select. By contrast, mutations are designed to produce side effects, such as in Buttons backed by tasks or runbooks. The distinction matters for requesting execution—In the context of a view, only mutations can be requested.

The backend always ensures that the caller has the right permissions when a task is executed, but views also proactively check permissions and render according to the user's permissions/roles.

Views are rendered as normal.

View components that are backed by task queries don't render any data, and instead display an error message saying that permissions are missing. Buttons are rendered as normal, but clicking on a button opens up a dialog that enables users to request that task or runbook.

View components that are backed by task queries don't render any data, and instead display an error message saying that permissions are missing. Buttons are disabled.