feat: personal canvas dashboard by AdityaHegde · Pull Request #9507 · rilldata/rill

AdityaHegde · 2026-05-28T12:23:07Z

Adds a personal canvas dashboard feature under personal_canvases feature flag. Saved as virtual files with user id as owner. These wont show up in primary dashboard lists but will show up in status with a user icon beside it.

Users can create personal canvas dashboards from home page.
Users can edit these personal canvases similar to rill developer.
Users can share them with every one on the project, this will make it appear in list of dashboards.

Closes ENG-1123

Checklist:

Covered by tests
Ran it and it works as intended
Reviewed the diff before requesting a review
Checked for unhandled edge cases
Linked the issues it closes
Checked if the docs need to be updated. If so, create a separate Linear DOCS issue
Intend to cherry-pick into the release branch
I'm proud of this work!

nishantmonu51

A few correctness bugs (two nil-pointer panics, a crash in the dashboard listing) and leftover debug logging, plus a layering and an access-control concern. Details inline.

Developed in collaboration with Claude Code

nishantmonu51 · 2026-06-11T21:20:44Z

+	}
+	ownedByUser := userID != "" && userID == spec.Annotations["admin_owner_user_id"]
+
+	shared, ok := spec.Annotations["admin_shared"]


When admin_shared is "true" this allows any claims, including public-URL/magic-token contexts, not just project members. The share UI describes this as sharing "with all users in the project"; if that is the intent, the rule should require an authenticated project user rather than allowing all callers.

These apply on top of underlying access rules. So it wont be accessible by users outside of the project. I can double check once to make sure

Confirmed it is not accessible by users outside of the project.

nishantmonu51 · 2026-06-22T10:43:50Z

@begelundmuller : Can you also do a quick review here ?

Copilot

Pull request overview

Adds a personal canvas dashboard feature behind the personalCanvases / personal_canvases feature flag. Personal dashboards are stored as owner-scoped virtual files (via new admin APIs) and are treated as admin-managed canvases through canvas annotations, with UI affordances to distinguish them in listings/status.

Changes:

Introduces a FileIO abstraction and wires fileArtifacts to use either runtime-backed IO or admin “virtual personal file” IO.
Adds admin server + web-admin client support for listing/creating/getting/editing/deleting personal files, backed by virtual_files.owner_id.
Extends canvas spec with annotations and updates UI to list/edit personal dashboards and mark them in status.

Reviewed changes

Copilot reviewed 51 out of 56 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
web-local/src/routes/+layout.ts	Passes a `RuntimeFileIO` into `fileArtifacts` setup.
web-common/src/features/entity-management/FileAndResourceWatcher.svelte	Sets `fileArtifacts` client + runtime IO early for descendants.
web-common/src/features/entity-management/file-artifacts.ts	Updates `fileArtifacts` to depend on a `FileIO` implementation.
web-common/src/features/entity-management/file-io.ts	Adds `FileIO` interface + runtime-backed implementation.
web-common/src/features/feature-flags.ts	Adds `personalCanvases` feature flag.
web-common/src/layout/workspace/WorkspaceHeader.svelte	Adds `showBreadcrumbs` option for isolated editor layouts.
web-common/src/features/projects/status/NameCell.svelte	Adds personal-owner icon + tooltip in status table cells.
web-common/src/runtime-client/gen/index.schemas.ts	Adds `annotations` to `V1CanvasSpec` (type currently too loose).
web-common/src/proto/gen/rill/runtime/v1/resources_pb.ts	Adds `CanvasSpec.annotations` map field in generated TS proto.
web-common/src/proto/gen/rill/admin/v1/api_pb.ts	Adds generated admin API messages for personal files.
runtime/security.go	Uses canvas annotations to treat admin-managed canvases as owner/admin-only.
admin/server/virtual_file.go	Implements personal file CRUD and injects admin-managed annotations into YAML.
admin/database/postgres/migrations/0094.sql	Adds `owner_id` column to `virtual_files`.
admin/database/database.go	Plumbs `owner_id` through DB types/options.
admin/database/postgres/postgres.go	Adds queries/upserts for owner-scoped virtual files.
proto/gen/rill/admin/v1/api.pb.gw.go	Adds gateway handlers for personal file endpoints.
proto/gen/rill/admin/v1/api_grpc.pb.go	Adds gRPC stubs for personal file endpoints.
web-admin/src/client/gen/default/default.ts	Adds web-admin HTTP client + query helpers for personal files.
web-admin/src/client/gen/index.schemas.ts	Adds web-admin schema types for personal file endpoints.
web-admin/src/features/personal-files/selectors.ts	Combines personal-file list + runtime resources into filtered selectors.
web-admin/src/features/personal-files/virtual-file-io.ts	Implements admin-backed `FileIO` for personal virtual files.
web-admin/src/features/personal-files/SharePersonalFile.svelte	Adds UI to toggle sharing via `admin_shared` annotation.
web-admin/src/features/personal-files/canvas/CreatePersonalCanvasDialog.svelte	Create/copy flow for personal dashboards.
web-admin/src/features/personal-files/canvas/PersonalCanvasesList.svelte	Renders “My dashboards” section.
web-admin/src/features/personal-files/canvas/PersonalCanvasCompositeCell.svelte	Cell renderer for personal dashboard list entries.
web-admin/src/features/personal-files/canvas/VirtualCanvasEditor.svelte	Isolated canvas editor for personal dashboards.
web-admin/src/features/personal-files/canvas/CanvasPersonalFile.svelte	Personal dashboard view/edit wrapper + delete flow.
web-admin/src/features/personal-files/canvas/mode-utils.ts	Stores per-dashboard view/edit mode.
web-admin/src/features/dashboards/listing/selectors.ts	Filters dashboards list to include/exclude personal dashboards based on annotations.
web-admin/src/features/projects/status/selectors.ts	Determines whether a resource is “personal” based on annotations.
web-admin/src/features/projects/ProjectHeader.svelte	Shows share controls for personal dashboards, hides project share on personal page.
web-admin/src/routes/[organization]/[project]/+page.svelte	Adds personal dashboards section + create button integration.
web-admin/src/routes/[organization]/[project]/-/personal/+layout.ts	Provides `VirtualFileIo` to the personal routes.
web-admin/src/routes/[organization]/[project]/-/personal/+layout.svelte	Injects admin `VirtualFileIo` into `fileArtifacts` for personal pages.
web-admin/src/routes/[organization]/[project]/-/personal/[name]/+page.ts	Loads the personal file YAML from admin service.
web-admin/src/routes/[organization]/[project]/-/personal/[name]/+page.svelte	Binds the loaded YAML into a `FileArtifact` and renders the personal canvas page.

Files not reviewed (4)

proto/gen/rill/admin/v1/api.pb.gw.go: Generated file
proto/gen/rill/admin/v1/api_grpc.pb.go: Generated file
proto/gen/rill/runtime/v1/resources.pb.go: Generated file
proto/gen/rill/runtime/v1/resources.pb.validate.go: Generated file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

begelundmuller · 2026-06-22T14:50:15Z

+		return nil, err
+	}
+
+	return res.Resource.Resource.(*runtimev1.Resource_Canvas).Canvas.Spec, nil


Could it be a problem that it returns Spec and not ValidSpec?

Yes this is a copy paste error. Updated to return ValidSpec

begelundmuller · 2026-06-22T14:55:58Z

+	var doc map[string]any
+	if err := yaml.Unmarshal([]byte(data), &doc); err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "invalid YAML: %s", err.Error())
+	}
+	if doc == nil {
+		doc = map[string]any{}
+	}
+
+	if displayName != "" {
+		doc["display_name"] = displayName
+	}
+
+	annotations, _ := doc["annotations"].(map[string]any)
+	if annotations == nil {
+		annotations = map[string]any{}
+	}
+	annotations["admin_owner_user_id"] = ownerID
+	annotations["admin_managed"] = "true"
+	annotations["admin_nonce"] = time.Now().Format(time.RFC3339Nano)
+	doc["annotations"] = annotations
+
+	out, err := yaml.Marshal(doc)


Maybe I'm missing something, but I don't see a check that doc["type"] == kind?

Generally would be good to carefully audit this code and ensure it only allows creation of canvas resources, not any other resource types (which could be a significant security leak).

The initial yaml came from UI in the current path so explicit setting was not needed. But I updated to have an explit set in the backend to prevent clients creating non-canvas dashbaords.

* feat: personal canvas dashboard * Update APIs * Add the UI for viewing personal files * Fix security policies * fix edge cases with save/load * Add edit/preview modes * Fix first component stuck on loading spinner * Add sharing support * Add delete * Fix canvas not in list * fix lint * PR comments * Use switch for canvas source selection * PR comments * PR comments and bug fixes --------- Co-authored-by: Nishant Bangarwa <nishant.monu51@gmail.com>

This reverts commit 5dbdec6.

AdityaHegde added 6 commits May 28, 2026 17:51

feat: personal canvas dashboard

8e358c3

Update APIs

8a13cb5

Add the UI for viewing personal files

fa89a92

Fix security policies

7bd0f44

fix edge cases with save/load

b5928c7

Add edit/preview modes

ab9b54f

nishantmonu51 mentioned this pull request Jun 2, 2026

feat: personal canvas dashboards for Rill Cloud #9509

Closed

8 tasks

nishantmonu51 and others added 7 commits June 3, 2026 00:19

Merge branch 'main' into feat/personal-canvas-dashboard

97be92f

Fix first component stuck on loading spinner

f00e7e2

Add sharing support

9df3882

Add delete

7643160

Fix canvas not in list

0ea3a2d

Merge branch 'main' into feat/personal-canvas-dashboard

78a4203

Merge branch 'main' into feat/personal-canvas-dashboard

d8a55ff

AdityaHegde force-pushed the feat/personal-canvas-dashboard branch from 0daacba to 3fc2cd5 Compare June 11, 2026 05:28

fix lint

d1fc6ca

AdityaHegde force-pushed the feat/personal-canvas-dashboard branch from 3fc2cd5 to d1fc6ca Compare June 11, 2026 05:29

nishantmonu51 reviewed Jun 11, 2026

View reviewed changes

AdityaHegde added 2 commits June 12, 2026 12:56

PR comments

23d81b6

Use switch for canvas source selection

7a296b4

AdityaHegde marked this pull request as ready for review June 12, 2026 12:24

AdityaHegde requested a review from nishantmonu51 June 12, 2026 12:24

nishantmonu51 requested a review from Copilot June 22, 2026 10:43

Copilot started reviewing on behalf of nishantmonu51 June 22, 2026 10:43 View session

Copilot AI reviewed Jun 22, 2026

View reviewed changes

AdityaHegde added 2 commits June 22, 2026 18:18

Merge branch 'main' into feat/personal-canvas-dashboard

21f1233

PR comments

13ed8b0

AdityaHegde force-pushed the feat/personal-canvas-dashboard branch from 59ed587 to 13ed8b0 Compare June 22, 2026 13:13

begelundmuller reviewed Jun 22, 2026

View reviewed changes

PR comments and bug fixes

70a85cf

AdityaHegde requested a review from begelundmuller June 23, 2026 06:35

begelundmuller approved these changes Jun 24, 2026

View reviewed changes

AdityaHegde merged commit 67ef247 into main Jun 25, 2026
22 of 23 checks passed

AdityaHegde deleted the feat/personal-canvas-dashboard branch June 25, 2026 04:07

nishantmonu51 added a commit that referenced this pull request Jun 25, 2026

Revert "feat: personal canvas dashboard (#9507)"

be9c7c5

This reverts commit 5dbdec6.

Uh oh!

Conversation

AdityaHegde commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nishantmonu51 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nishantmonu51 Jun 11, 2026

Choose a reason for hiding this comment

Uh oh!

AdityaHegde Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

AdityaHegde Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

nishantmonu51 commented Jun 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

begelundmuller Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

AdityaHegde Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

begelundmuller Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

AdityaHegde Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

AdityaHegde commented May 28, 2026 •

edited

Loading