Issue 5722: Edit Project for non-owners

Preview: https://rancherproj-quota-viewr.mf-created-dashboard.ui.rancher.space/dashboard/, built from f292dd2 (fork branch project-view-quota-guards, 3 commits on master 8ded74c), backend mf Rancher v2.16.0. Checked 2026-10-27.

Verdict: real bug on 2.16; the branch meets all four of the issue's expected results

On a Rancher without the Harvester UI extension, every project role gets Edit Config in the project's ⋮ menu. On master that page lets a Member rename the project or remove quotas, and Save then drops it all without a word. A View Workloads user also gets an empty Members tab they aren't allowed to read.
The branch makes the form follow what the user can do on this project, using the same per-project permission check the 9049 fix (PR 18840) uses for the members page.
Edit Config still shows in the menu for every role (like the 9049 nav entry, it stays on the global check). Users who can't change anything land on a read-only page with no Save.

Recording

Master: a Project Member renames the project and removes the Pods quota, saves, and reopens it: nothing was saved, no error. Then the fix branch as Member, View Workloads, Manage Project Members and Owner. Harvester UI extension blocked in this browser. 2 min.

The issue's expected results, checked on the preview

Issue's role (test user)	Expected	Master	Fix branch
Project Owner (owner)	Project + Members editable	Yes	Yes
Manage Project Members (manage)	Members editable, Project blocked	Name editable, quota Add/Remove shown	Members Add/Remove + Save; project fields locked
View Project Members (viewmem)	Both blocked	Name, quotas editable; Save drops it	Read-only page, read-only members list, no Save
View Project Catalog (gone in 2.16; viewwl = View Workloads)	Members not available, Project blocked	Empty Members tab; Name, quotas editable	No Members tab, read-only, no Save
Project Member, Read-only (not in the issue)	–	Name, quotas editable	Read-only, read-only members list, no Save

Same results on the read-only project page (no Members tab for View Workloads; no quota Add/Remove for anyone). Manage adding a member from Edit Config: one POST (201), no project write.

Before and after

Master, Project Member: Name editable, quota Remove and Add Resource shown — **Master, Member:** Name editable, quota Remove and Add Resource shown. None of it saves.

Fix, Project Member: read-only — **Fix, Member:** read-only and no Save; Members tab is a read-only list.

Fix, View Workloads: no Members tab — **Fix, View Workloads:** no Members tab.

Fix, Manage Project Members: members editable — **Fix, Manage Project Members:** members editable with Save; project fields locked.

The fix (3 commits)

Quota Add Resource and Remove follow view mode

shell/components/form/ResourceQuota/Project.vue · ResourceQuotaEntry.vue

Regression

Before the Feb 2026 quota rewrite the rows lived in an ArrayList, which hid both buttons in view mode. The new components ignored the mode, so they showed on every read-only project page too. Now hidden in view mode; the header row goes full width when the Remove column is gone.

Name locks with Description

shell/edit/management.cattle.io.project.vue

Bug

Description was already disabled for users without the project's update link; Name never was. Matters for the Manage Project Members user, who keeps an editable form.

The form follows this project's member permissions

shell/edit/management.cattle.io.project.vue · shell/utils/project-permissions.ts

Bug

The form used the global binding schema (which every test user has) to decide on the Members tab. It now loads this project's permissions with fetchProjectMembershipPermissions, which already gives the 9049 members page its per-project Add/✕. The helper also returns view (list) now, next to create/remove.

Members tab: only if the user can list this project's members (always on create).
Read-only form, no Save: when the user can neither update the project nor manage its members.
Owner and Manage keep an edit form; Manage still adds members from here, which is why the page isn't guarded as a whole.

Tests

Done

New cases in ResourceQuotaEntry.test.ts, Project.test.ts, project-permissions.test.ts and management.cattle.io.project.test.js (fetch, form mode per permission, Members tab, Name/Description). Full suite: 867 suites pass. Lint clean, type-check no new errors.

The Harvester extension trap

The Harvester UI extension ships its own pkg/harvester/edit/management.cattle.io.project.vue and project model. Extension components register by type, globally, so once it's installed its copy replaces the core project page and menu on every cluster. On mf that hides Edit Config from non-owners and shows Harvester's page instead.

To see the core page on mf or a preview, block *uiplugins/harvester* in DevTools (Network → right-click → Block request URL), then reload.
Installs with the extension keep Harvester's copy until it's rebuilt or fixed there. Worth an issue on harvester-ui-extension.

Test it yourself

In DevTools, block *uiplugins/harvester*, then log in to the fix preview as one of zz9049-owner, -manage, -viewmem, -member, -readonly, -viewwl (test password: ask me; it isn't on this page).
⋮ on zz9049-project-a → Edit Config, and compare with the table above.
Same on master (mf) for the before.

Not covered

Edit Config in the menu stays on the global check, like the 9049 nav entry. Making it per project means loading permissions for every project in the list up front; separate change.
Harvester's copy of the page (above).
Manage Project Members' Add dialog offers roles that user can't grant, and the server's refusal shows as raw JSON (found during 9049; not part of 5722).