Merge latest V2 UI base

Resolve configuration and release note conflicts while retaining both branches' changes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: paullizer

application/single_app/admin_settings_fields.py

@@ -638,6 +638,38 @@ def iter_tabs():
             yield group, tab
 
 
+# Tabs that existed before the information architecture rework, mapped to where
+# their content now lives. ``LEGACY_TAB_REDIRECTS`` in
+# ``static/js/admin/admin_sidebar_nav.js`` resolves the same ids for the
+# server-rendered page; this copy lets the server resolve a Latest Features
+# shortcut for the V2 surface, and a functional test keeps the two identical.
+LEGACY_TAB_REDIRECTS = {
+    "governance": "feature-governance",
+    "scale": "redis-caching",
+    "general": "branding",
+    "safety": "access-roles",
+    "security": "secrets",
+    "workspaces": "workspace-types",
+    "search-extract": "web-research",
+    "ai-models": "model-endpoints",
+    "data-management": "backup",
+}
+
+
+def resolve_admin_tab_id(tab_id):
+    """Return the live tab id for a current or pre-rework tab id.
+
+    A leading ``#`` is accepted because Latest Features shortcuts store their
+    target as a fragment. Returns None when the id names no tab, directly or
+    through ``LEGACY_TAB_REDIRECTS``.
+    """
+    candidate = str(tab_id or "").strip().lstrip("#")
+    if not candidate:
+        return None
+    candidate = LEGACY_TAB_REDIRECTS.get(candidate, candidate)
+    return candidate if candidate in get_tab_ids() else None
+
+
 def get_tab_ids():
     """Return every tab id in navigation order."""
     return [tab["id"] for _, tab in iter_tabs()]

application/single_app/admin_settings_nav.py

@@ -101,7 +101,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.261.276"
+VERSION = "0.261.278"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 # Opt-out for deployments where App Service Easy Auth is active but the platform

application/single_app/config.py

@@ -16,14 +16,21 @@
 from config import cosmos_activity_logs_container
 
 
+def build_activity_log_id(activity_type, user_id, idempotency_key):
+    """Build the stable activity record ID used for idempotent writes."""
+    if not isinstance(idempotency_key, str) or not idempotency_key or len(idempotency_key) > 512:
+        raise ValueError("The activity idempotency key is invalid.")
+    return str(uuid.uuid5(
+        uuid.NAMESPACE_URL,
+        f"simplechat:{activity_type}:{user_id}:{idempotency_key}",
+    ))
+
+
 def _create_activity_record(record, idempotency_key=None):
     if idempotency_key is not None:
-        if not isinstance(idempotency_key, str) or not idempotency_key or len(idempotency_key) > 512:
-            raise ValueError("The activity idempotency key is invalid.")
-        record["id"] = str(uuid.uuid5(
-            uuid.NAMESPACE_URL,
-            f"simplechat:{record['activity_type']}:{record['user_id']}:{idempotency_key}",
-        ))
+        record["id"] = build_activity_log_id(
+            record['activity_type'], record['user_id'], idempotency_key
+        )
     try:
         cosmos_activity_logs_container.create_item(body=record)
     except CosmosResourceExistsError:
@@ -33,6 +40,37 @@ def _create_activity_record(record, idempotency_key=None):
     return record
 
 
+def has_activity_log_for_resource(user_id, activity_type, resource_id, workspace_type=None):
+    """Check for an existing creation record within its user partition."""
+    if not user_id or not resource_id:
+        return False
+
+    if activity_type == 'conversation_creation':
+        resource_path = 'c.conversation.conversation_id'
+    elif activity_type == 'document_creation':
+        resource_path = 'c.document.document_id'
+    else:
+        raise ValueError("Unsupported activity type for resource lookup.")
+
+    query = (
+        "SELECT TOP 1 VALUE c.id FROM c "
+        f"WHERE c.activity_type = @activity_type AND {resource_path} = @resource_id"
+    )
+    parameters = [
+        {'name': '@activity_type', 'value': activity_type},
+        {'name': '@resource_id', 'value': resource_id},
+    ]
+    if workspace_type:
+        query += " AND c.workspace_type = @workspace_type"
+        parameters.append({'name': '@workspace_type', 'value': workspace_type})
+    matches = cosmos_activity_logs_container.query_items(
+        query=query,
+        parameters=parameters,
+        partition_key=user_id,
+    )
+    return next(iter(matches), None) is not None
+
+
 def coerce_activity_log_user_id(user_id: Any) -> str:
     """Extract a stable string user id from a scalar or session-style identity payload."""
     if user_id is None:

application/single_app/functions_activity_logging.py

@@ -959,6 +959,47 @@ def decorated_function(*args, **kwargs):
             return "Forbidden", 403
     return decorated_function
 
+def get_control_center_capabilities(user=None, settings=None):
+    """Return the Control Center permissions implied by the user's roles and settings."""
+    user = session.get('user', {}) if user is None else user
+    settings = get_settings() if settings is None else settings
+    require_admin_role = settings.get("require_member_of_control_center_admin", False)
+    require_dashboard_reader_role = settings.get(
+        "require_member_of_control_center_dashboard_reader", False
+    )
+
+    has_control_center_admin_role = (
+        'roles' in user and 'ControlCenterAdmin' in user['roles']
+        if isinstance(user, dict)
+        else False
+    )
+    has_dashboard_reader_role = (
+        'roles' in user and 'ControlCenterDashboardReader' in user['roles']
+        if isinstance(user, dict)
+        else False
+    )
+    has_regular_admin_role = (
+        'roles' in user and 'Admin' in user['roles']
+        if isinstance(user, dict)
+        else False
+    )
+
+    has_full_access = (
+        has_control_center_admin_role if require_admin_role else has_regular_admin_role
+    )
+    can_view_dashboard = has_full_access or (
+        require_dashboard_reader_role and has_dashboard_reader_role
+    )
+    return {
+        'can_view_dashboard': bool(can_view_dashboard),
+        'can_manage_users': bool(has_full_access),
+        'can_manage_groups': bool(has_full_access),
+        'can_manage_workspaces': bool(has_full_access),
+        'can_view_activity_logs': bool(has_full_access),
+        'can_run_maintenance': bool(has_full_access),
+    }
+
+
 def control_center_required(access_level='admin'):
     """
     Unified Control Center access control decorator.
@@ -984,48 +1025,34 @@ def decorated_function(*args, **kwargs):
             user = session.get('user', {})
             settings = get_settings()
             require_member_of_control_center_admin = settings.get("require_member_of_control_center_admin", False)
-            require_member_of_control_center_dashboard_reader = settings.get("require_member_of_control_center_dashboard_reader", False)
-
-            has_control_center_admin_role = 'roles' in user and 'ControlCenterAdmin' in user['roles']
-            has_dashboard_reader_role = 'roles' in user and 'ControlCenterDashboardReader' in user['roles']
-            has_regular_admin_role = 'roles' in user and 'Admin' in user['roles']
-            
-            # Check if ControlCenterAdmin role requirement is enforced
-            if require_member_of_control_center_admin:
-                # ControlCenterAdmin role is REQUIRED for access
-                # Only ControlCenterAdmin role grants full access
-                if has_control_center_admin_role:
-                    return f(*args, **kwargs)
-                
-                # For dashboard access, check if DashboardReader role grants access
-                if access_level == 'dashboard':
-                    if require_member_of_control_center_dashboard_reader and has_dashboard_reader_role:
-                        return f(*args, **kwargs)
-                
-                # User doesn't have ControlCenterAdmin role, deny access
-                # Note: Regular Admin role does NOT grant access when this setting is enabled
-                is_api_request = (request.accept_mimetypes.accept_json and not request.accept_mimetypes.accept_html) or request.path.startswith('/api/')
-                if is_api_request:
-                    return jsonify({"error": "Forbidden", "message": "Insufficient permissions (ControlCenterAdmin role required)"}), 403
-                else:
-                    return "Forbidden: ControlCenterAdmin role required", 403
-            
-            # ControlCenterAdmin requirement is NOT enforced (default behavior)
-            # Only regular Admin role grants access - ControlCenterAdmin role is IGNORED
-            if has_regular_admin_role:
+            capabilities = get_control_center_capabilities(user, settings)
+            permitted = (
+                capabilities['can_view_dashboard']
+                if access_level == 'dashboard'
+                else capabilities['can_manage_users']
+            )
+            if permitted:
                 return f(*args, **kwargs)
 
-            # For dashboard-only access, check if DashboardReader role is enabled and user has it
-            if access_level == 'dashboard':
-                if require_member_of_control_center_dashboard_reader and has_dashboard_reader_role:
-                    return f(*args, **kwargs)
-            
             # User is not an admin and doesn't have special roles - deny access
             is_api_request = (request.accept_mimetypes.accept_json and not request.accept_mimetypes.accept_html) or request.path.startswith('/api/')
             if is_api_request:
-                return jsonify({"error": "Forbidden", "message": "Insufficient permissions (Admin role required)"}), 403
+                required_role = (
+                    "ControlCenterAdmin"
+                    if require_member_of_control_center_admin
+                    else "Admin"
+                )
+                return jsonify({
+                    "error": "Forbidden",
+                    "message": f"Insufficient permissions ({required_role} role required)",
+                }), 403
             else:
-                return "Forbidden: Admin role required", 403
+                required_role = (
+                    "ControlCenterAdmin"
+                    if require_member_of_control_center_admin
+                    else "Admin"
+                )
+                return f"Forbidden: {required_role} role required", 403
         return decorated_function
     return decorator