Skip to content

fix(core): pass meta to useButtonCanAccess in useDeleteButton#7316

Closed
Aaron3312 wants to merge 1 commit intorefinedev:mainfrom
Aaron3312:fix/delete-button-meta-access-control
Closed

fix(core): pass meta to useButtonCanAccess in useDeleteButton#7316
Aaron3312 wants to merge 1 commit intorefinedev:mainfrom
Aaron3312:fix/delete-button-meta-access-control

Conversation

@Aaron3312
Copy link
Contributor

PR Checklist

Bugs / Features

What is the current behavior?

useDeleteButton does not forward the meta prop to useButtonCanAccess, so access control checks via useCan receive undefined for params.meta. This breaks any custom access control rule that relies on meta (e.g. tenant-aware permission systems).

What is the new behavior?

meta: props.meta is now passed to useButtonCanAccess, matching the same pattern already used by navigation-button. Access control checks now receive the correct meta params.

fixes #7285

Notes for reviewers

One-line fix. The navigation-button hook already does this correctly at line 60 — this just applies the same pattern to delete-button.

@Aaron3312 Aaron3312 requested a review from a team as a code owner March 1, 2026 09:56
@changeset-bot
Copy link

changeset-bot bot commented Mar 1, 2026

🦋 Changeset detected

Latest commit: a9f9cdf

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@refinedev/core Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@Moses-main

This comment was marked as spam.

Copy link

@YinHeaven YinHeaven left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

Copy link
Member

@alicanerdurmaz alicanerdurmaz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi, thanks for improving Refine.

Everything looks great except changeset file names should be auto-generated.

@alicanerdurmaz
Copy link
Member

this commit shouldn't be in this PR

useDeleteButton was not forwarding the meta prop to useButtonCanAccess,
causing access control checks that rely on meta params (e.g.
tenant-aware permissions) to receive undefined instead of the provided
meta values.

Other button hooks (navigation-button) already pass meta correctly.
This aligns useDeleteButton with the same pattern.

Fixes refinedev#7285
@Aaron3312 Aaron3312 force-pushed the fix/delete-button-meta-access-control branch from b5e37b8 to a9f9cdf Compare March 5, 2026 21:56
@Aaron3312
Copy link
Contributor Author

Thanks for the feedback! I've fixed both issues:

  • Rebased the branch onto main to remove the unrelated CLI commit
  • Renamed the changeset file to an auto-generated name (serious-berries-check.md)

@alicanerdurmaz
Copy link
Member

Thank you very much for your effort, @Aaron3312, but we are closing this PR in favor of this PR. We did this because the other PR was opened earlier.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] useDeleteButton does not pass meta params to useButtonCanAccess in refine/core

4 participants