diff --git a/frontend-modern/src/components/Infrastructure/__tests__/ResourceDetailDrawer.history.test.tsx b/frontend-modern/src/components/Infrastructure/__tests__/ResourceDetailDrawer.history.test.tsx
index 42b6336174..f2aae31180 100644
--- a/frontend-modern/src/components/Infrastructure/__tests__/ResourceDetailDrawer.history.test.tsx
+++ b/frontend-modern/src/components/Infrastructure/__tests__/ResourceDetailDrawer.history.test.tsx
@@ -1,5 +1,11 @@
import { describe, expect, it, vi } from 'vitest';
-import { fireEvent, render as solidRender, screen, within } from '@solidjs/testing-library';
+import {
+ fireEvent,
+ render as solidRender,
+ screen,
+ within,
+ waitFor,
+} from '@solidjs/testing-library';
import { Suspense } from 'solid-js';
import discoveryTabSource from '@/components/Discovery/DiscoveryTab.tsx?raw';
@@ -1404,4 +1410,61 @@ describe('ResourceDetailDrawer change history section', () => {
expect(await panel.findByText('CPU spike detected')).toBeInTheDocument();
expect(panel.queryByText('Routine restart requested')).toBeNull();
});
+ it('does not re-display embedded changes after a denied facet read', async () => {
+ facetBundleMock.getFacetBundle.mockRejectedValueOnce(
+ Object.assign(new Error('private response detail'), { status: 403 }),
+ );
+ render(() => (
+
+ ));
+ const history = screen.getByTestId('resource-change-history-section');
+ await waitFor(() =>
+ expect(within(history).getByRole('alert')).toHaveTextContent(
+ 'Access denied. Check your permissions and license plan.',
+ ),
+ );
+ expect(history).not.toHaveTextContent('Embedded snapshot actor');
+ expect(history).not.toHaveTextContent('No events yet.');
+ expect(history).not.toHaveTextContent('Changes loaded');
+ expect(within(history).getByRole('button', { name: /^Retry$/ })).toBeInTheDocument();
+ });
+
+ it('keeps a failed first action read and retry visible in Manage', async () => {
+ actionAuditMock.listActionAudits.mockRejectedValueOnce(
+ Object.assign(new Error('Actions temporarily unavailable'), { status: 503 }),
+ );
+ render(() =>
);
+ fireEvent.click(screen.getByRole('tab', { name: 'Manage' }));
+ await waitFor(() =>
+ expect(screen.getByTestId('resource-action-history-section')).toHaveTextContent(
+ 'Actions temporarily unavailable',
+ ),
+ );
+ const actions = screen.getByTestId('resource-action-history-section');
+ expect(actions).toHaveTextContent('Actions unavailable');
+ expect(actions).not.toHaveTextContent('No actions yet.');
+ actionAuditMock.listActionAudits.mockResolvedValueOnce({
+ audits: [],
+ count: 0,
+ available: true,
+ });
+ fireEvent.click(within(actions).getByRole('button', { name: /^Retry$/ }));
+ await waitFor(() => expect(actions).toHaveTextContent('No actions yet.'));
+ expect(actions).not.toHaveTextContent('Actions temporarily unavailable');
+ });
});
diff --git a/frontend-modern/src/components/Infrastructure/__tests__/useResourceDetailDrawerHistoryState.access.test.tsx b/frontend-modern/src/components/Infrastructure/__tests__/useResourceDetailDrawerHistoryState.access.test.tsx
new file mode 100644
index 0000000000..e32c80776f
--- /dev/null
+++ b/frontend-modern/src/components/Infrastructure/__tests__/useResourceDetailDrawerHistoryState.access.test.tsx
@@ -0,0 +1,166 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, fireEvent, render, screen, waitFor } from '@solidjs/testing-library';
+import { useResourceDetailDrawerHistoryState } from '../useResourceDetailDrawerHistoryState';
+import type { Resource, ResourceChange } from '@/types/resource';
+import { resetCreateNonSuspendingQueryCacheForTest } from '@/hooks/createNonSuspendingQuery';
+
+const api = vi.hoisted(() => ({ facets: vi.fn(), intelligence: vi.fn(), actions: vi.fn() }));
+vi.mock('@/api/resources', () => ({ ResourceAPI: { getFacetBundle: api.facets } }));
+vi.mock('@/api/ai', () => ({ AIAPI: { getResourceIntelligence: api.intelligence } }));
+vi.mock('@/api/actionAudit', () => ({ ActionAuditAPI: { listActionAudits: api.actions } }));
+
+const change = (id: string): ResourceChange => ({
+ id,
+ resourceId: 'pbs-a',
+ observedAt: '2026-10-03T03:00:00Z',
+ kind: 'restart',
+ sourceType: 'platform_event',
+ confidence: 'high',
+});
+const resource: Resource = {
+ id: 'pbs-a',
+ name: 'PBS A',
+ displayName: 'PBS A',
+ type: 'pbs',
+ platformId: 'pbs-a',
+ platformType: 'proxmox-pbs',
+ sourceType: 'api',
+ status: 'online',
+ lastSeen: 1,
+ recentChanges: [change('embedded-event')],
+ facetCounts: { recentChanges: 7 },
+};
+const bundle = (id = 'remote-event') => ({
+ recentChanges: [change(id)],
+ counts: { recentChanges: 1 },
+});
+const failure = (status: number) =>
+ Object.assign(new Error('untrusted response detail'), { status });
+
+function Probe(props: { remote?: boolean }) {
+ const state = useResourceDetailDrawerHistoryState({
+ resource,
+ enableRemoteHistory: props.remote,
+ });
+ return (
+ <>
+
+
+
+
+
+
+ );
+}
+const read = () => JSON.parse(screen.getByTestId('history-state').textContent!);
+beforeEach(() => {
+ api.facets.mockReset().mockResolvedValue(bundle());
+ api.intelligence.mockReset().mockResolvedValue(null);
+ api.actions.mockReset().mockResolvedValue({ audits: [], count: 0, available: false });
+});
+afterEach(() => {
+ cleanup();
+ resetCreateNonSuspendingQueryCacheForTest();
+});
+
+describe('resource evidence access boundaries', () => {
+ it.each([401, 403])('does not substitute embedded events after final HTTP %s', async (status) => {
+ render(() =>
);
+ await waitFor(() => expect(read().ids).toEqual(['remote-event']));
+ api.facets.mockRejectedValueOnce(failure(status));
+ fireEvent.click(screen.getByText('Refresh changes'));
+ await waitFor(() => expect(read().error).not.toBe(''));
+ expect(read().ids).toEqual([]);
+ expect(read().count).toBe(0);
+ expect(read().error).toBe(
+ status === 401
+ ? 'Sign in again or check your API token.'
+ : 'Access denied. Check your permissions and license plan.',
+ );
+ expect(read().label).toBe('Changes unavailable');
+ });
+
+ it('withdraws embedded events when the initial read is denied', async () => {
+ api.facets.mockRejectedValueOnce(failure(403));
+ render(() =>
);
+ await waitFor(() => expect(read().error).not.toBe(''));
+ expect(read().ids).toEqual([]);
+ expect(read().count).toBe(0);
+ });
+
+ it('does not substitute an unfiltered bundle after a filtered access denial', async () => {
+ render(() =>
);
+ await waitFor(() => expect(read().ids).toEqual(['remote-event']));
+ api.facets.mockRejectedValueOnce(failure(403));
+ fireEvent.click(screen.getByText('Filter changes'));
+ await waitFor(() => expect(read().error).not.toBe(''));
+ expect(read().ids).toEqual([]);
+ expect(read().count).toBe(0);
+ // The unfiltered request retains its own successful authorisation.
+ fireEvent.click(screen.getByText('Clear changes filter'));
+ await waitFor(() => expect(read().ids).toEqual(['remote-event']));
+ });
+
+ it('keeps denied evidence withdrawn during retry, then accepts a fresh success', async () => {
+ render(() =>
);
+ await waitFor(() => expect(read().ids).toEqual(['remote-event']));
+ api.facets.mockRejectedValueOnce(failure(403));
+ fireEvent.click(screen.getByText('Refresh changes'));
+ await waitFor(() => expect(read().error).not.toBe(''));
+ let resolve!: (value: ReturnType
) => void;
+ api.facets.mockImplementationOnce(
+ () =>
+ new Promise((done) => {
+ resolve = done;
+ }),
+ );
+ fireEvent.click(screen.getByText('Refresh changes'));
+ await waitFor(() => expect(read().label).toBe('Refreshing changes...'));
+ expect(read().ids).toEqual([]);
+ resolve(bundle('fresh-event'));
+ await waitFor(() => expect(read().ids).toEqual(['fresh-event']));
+ expect(read().error).toBe('');
+ });
+
+ it.each([503])(
+ 'exposes an action read failure even without retained actions: %s',
+ async (status) => {
+ render(() => );
+ await waitFor(() => expect(read().actionsLabel).toBe('Actions loaded'));
+ api.actions.mockRejectedValueOnce(failure(status));
+ fireEvent.click(screen.getByText('Refresh actions'));
+ await waitFor(() => expect(read().actionsError).not.toBe(''));
+ expect(read().actionsLabel).toBe('Actions unavailable');
+ if (status === 401 || status === 403) expect(read().actionsError).not.toContain('untrusted');
+ expect(read().available).toBe(false);
+ },
+ );
+
+ it('retains a successful remote snapshot after a transient outage', async () => {
+ render(() => );
+ await waitFor(() => expect(read().ids).toEqual(['remote-event']));
+ api.facets.mockRejectedValueOnce(failure(503));
+ fireEvent.click(screen.getByText('Refresh changes'));
+ await waitFor(() => expect(read().error).not.toBe(''));
+ expect(read().ids).toEqual(['remote-event']);
+ expect(read().count).toBe(1);
+ });
+
+ it('keeps snapshot-only embedded history without making remote reads', async () => {
+ render(() => );
+ expect(read().ids).toEqual(['embedded-event']);
+ expect(read().count).toBe(7);
+ expect(api.facets).not.toHaveBeenCalled();
+ expect(api.actions).not.toHaveBeenCalled();
+ });
+});
diff --git a/frontend-modern/src/components/Infrastructure/useResourceDetailDrawerHistoryState.ts b/frontend-modern/src/components/Infrastructure/useResourceDetailDrawerHistoryState.ts
index 1313a32174..2486a9687d 100644
--- a/frontend-modern/src/components/Infrastructure/useResourceDetailDrawerHistoryState.ts
+++ b/frontend-modern/src/components/Infrastructure/useResourceDetailDrawerHistoryState.ts
@@ -13,6 +13,7 @@ import { ActionAuditAPI } from '@/api/actionAudit';
import { ResourceAPI } from '@/api/resources';
import { createNonSuspendingQuery } from '@/hooks/createNonSuspendingQuery';
import type { ActionAuditListResponse } from '@/types/actionAudit';
+import { getAPIReadAccessErrorMessage } from '@/utils/apiAccessError';
interface UseResourceDetailDrawerHistoryStateOptions {
resource: Resource;
@@ -123,26 +124,44 @@ export const useResourceDetailDrawerHistoryState = (
const timelineFacets = timelineFacetsState.value;
const refetchTimelineFacets = timelineFacetsState.refetch;
- const resourceTimeline = createMemo(
- () => resourceFacets()?.recentChanges ?? resource().recentChanges ?? [],
+ const resourceFacetsAccessError = createMemo(() =>
+ getAPIReadAccessErrorMessage(resourceFacetsState.error()),
);
- const resourceFacetCapabilities = createMemo(
- () => resourceFacets()?.capabilities ?? resource().capabilities ?? [],
+ const timelineFacetsAccessError = createMemo(() =>
+ timelineFacetRequest() ? getAPIReadAccessErrorMessage(timelineFacetsState.error()) : null,
);
- const resourceFacetRelationships = createMemo(
- () => resourceFacets()?.relationships ?? resource().relationships ?? [],
+ // The query owner withdraws its value on denial. Snapshot/unfiltered
+ // fallbacks must not put that evidence back under the denied request.
+ const resourceTimeline = createMemo(() =>
+ resourceFacetsAccessError()
+ ? []
+ : (resourceFacets()?.recentChanges ?? resource().recentChanges ?? []),
);
- const resourceFacetCounts = createMemo(
- () => resourceFacets()?.counts ?? resource().facetCounts ?? null,
+ const resourceFacetCapabilities = createMemo(() =>
+ resourceFacetsAccessError()
+ ? []
+ : (resourceFacets()?.capabilities ?? resource().capabilities ?? []),
+ );
+ const resourceFacetRelationships = createMemo(() =>
+ resourceFacetsAccessError()
+ ? []
+ : (resourceFacets()?.relationships ?? resource().relationships ?? []),
+ );
+ const resourceFacetCounts = createMemo(() =>
+ resourceFacetsAccessError()
+ ? null
+ : (resourceFacets()?.counts ?? resource().facetCounts ?? null),
);
const historyFacetBundle = createMemo(() =>
timelineFacetRequest() ? (timelineFacets() ?? resourceFacets()) : resourceFacets(),
);
- const historyFacetCounts = createMemo(
- () => historyFacetBundle()?.counts ?? resourceFacetCounts() ?? null,
+ const historyFacetCounts = createMemo(() =>
+ timelineFacetsAccessError()
+ ? null
+ : (historyFacetBundle()?.counts ?? resourceFacetCounts() ?? null),
);
- const historyRecentChanges = createMemo(
- () => historyFacetBundle()?.recentChanges ?? resourceTimeline(),
+ const historyRecentChanges = createMemo(() =>
+ timelineFacetsAccessError() ? [] : (historyFacetBundle()?.recentChanges ?? resourceTimeline()),
);
const historyTimeline = createMemo(() => historyRecentChanges());
const hasTimelineFilters = createMemo(() =>
@@ -152,9 +171,15 @@ export const useResourceDetailDrawerHistoryState = (
if (timelineFacetRequest()) {
return timelineFacetsState.loading()
? 'Refreshing filtered changes...'
- : 'Filtered changes loaded';
+ : timelineFacetsState.error()
+ ? 'Filtered changes unavailable'
+ : 'Filtered changes loaded';
}
- return resourceFacetsState.loading() ? 'Refreshing changes...' : 'Changes loaded';
+ return resourceFacetsState.loading()
+ ? 'Refreshing changes...'
+ : resourceFacetsState.error()
+ ? 'Changes unavailable'
+ : 'Changes loaded';
});
const resourceTimelineCount = createMemo(
() => historyFacetCounts()?.recentChanges ?? historyRecentChanges().length,
@@ -176,7 +201,11 @@ export const useResourceDetailDrawerHistoryState = (
Boolean(actionAuditResponse().available || resourceActionAudits().length > 0),
);
const actionAuditLoadingLabel = createMemo(() =>
- actionAuditState.loading() ? 'Refreshing actions...' : 'Actions loaded',
+ actionAuditState.loading()
+ ? 'Refreshing actions...'
+ : actionAuditState.error()
+ ? 'Actions unavailable'
+ : 'Actions loaded',
);
const sortedActionAudits = createMemo(() =>
[...resourceActionAudits()].sort((left, right) => {
@@ -192,12 +221,20 @@ export const useResourceDetailDrawerHistoryState = (
? timelineFacetsState.error()
: resourceFacetsState.error();
if (!error) return '';
- return (error as Error)?.message || 'Failed to load resource history';
+ return (
+ getAPIReadAccessErrorMessage(error) ||
+ (error as Error)?.message ||
+ 'Failed to load resource history'
+ );
});
const actionAuditError = createMemo(() => {
const error = actionAuditState.error();
- if (!error || !actionAuditAvailable()) return '';
- return (error as Error)?.message || 'Failed to load action history';
+ if (!error) return '';
+ return (
+ getAPIReadAccessErrorMessage(error) ||
+ (error as Error)?.message ||
+ 'Failed to load action history'
+ );
});
const refetchHistoryFacets = () => {