feat(metadata-editor): hide Add metadata template button for non-editors

[dlasecki-box]

• hide "Add metadata template" button for users without can_upload permission to a file - as per Box documentation

Extra:

• cleanup additive gating after feat(hitl): decouple bboxes from confidence scores #4639
• update peer and dev dependencies on @box/metadata-editor upgrade

Summary by CodeRabbit

• Bug Fixes

  • Metadata template options now only appear when a file has upload permissions.
  • AI suggestion requests now send the right options based on the selected feature flags.
  • Bounding-box related requests now use the correct enablement logic.

• Tests

  • Expanded coverage for metadata button visibility and AI request payloads.

• Chores

  • Updated Box metadata package versions and added a new metadata taxonomy package.
  • Adjusted test configuration to include the updated package set.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 16965b4a-0749-41ce-b0fb-cfbf98ab41ed

📥 Commits

Reviewing files that changed from the base of the PR and between 51720a1 and f91ab58.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (7)

• package.json
• scripts/jest/jest.config.js
• src/elements/content-sidebar/MetadataSidebarRedesign.tsx
• src/elements/content-sidebar/__tests__/MetadataSidebarRedesign.test.tsx
• src/elements/content-sidebar/__tests__/useSidebarMetadataFetcher.test.tsx
• src/elements/content-sidebar/hooks/useSidebarMetadataFetcher.ts
• src/elements/content-sidebar/stories/__mocks__/MetadataSidebarRedesignedMocks.ts

---

Walkthrough

Updates Box metadata package versions, expands Jest transforms for the affected scoped packages, changes structured extraction requests to send include_reference only when bounding boxes are enabled, and gates the metadata dropdown on upload permission.

Changes

Metadata sidebar updates

Layer / File(s)	Summary
Package and Jest updates package.json, scripts/jest/jest.config.js	@box/metadata-editor and @box/metadata-template-browser are bumped, @box/metadata-taxonomy-picker is added, and Jest's transformIgnorePatterns allowlist is updated for the affected @box/* packages.
Structured extraction flags src/elements/content-sidebar/hooks/useSidebarMetadataFetcher.ts, src/elements/content-sidebar/__tests__/useSidebarMetadataFetcher.test.tsx	include_reference now follows isBoundingBoxEnabled, the hook dependency list changes accordingly, and tests cover confidence-only and combined flag requests.
Template visibility by permission src/elements/content-sidebar/MetadataSidebarRedesign.tsx, src/elements/content-sidebar/__tests__/MetadataSidebarRedesign.test.tsx, src/elements/content-sidebar/stories/__mocks__/MetadataSidebarRedesignedMocks.ts	The metadata dropdown now requires file.permissions.can_upload, and tests plus story mocks are updated for allowed, denied, and missing-permission cases.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• box/box-ui-elements#4639: Changes the same useSidebarMetadataFetcher bounding-box and confidence-score gating path.
• box/box-ui-elements#4491: Also updates useSidebarMetadataFetcher request payloads for include_confidence_score and include_reference.
• box/box-ui-elements#4505: Also updates Box metadata dependencies and Jest allowlisting in package.json and Jest config.

Suggested labels

ready-to-merge

Suggested reviewers

• Lindar90
• jfox-box

Poem

🐰 I hopped through the sidebar bright,
New packages glow in Jest's soft light.
Reference flags now know their way,
Upload gates keep templates at bay.
Ears up — metadata dances today!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely matches the main change: hiding the Add metadata template button for users without upload permission.
Description check	✅ Passed	The description covers the template content and clearly explains the main change, cleanup, and dependency updates.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​box/​metadata-taxonomy-picker@​3.1.8
	npm/​@​box/​metadata-editor@​1.73.11 ⏵ 2.2.11			+1
	npm/​@​box/​metadata-template-browser@​1.24.13 ⏵ 2.1.7

View full report