ui: Implement fine grained read-only views based on ACLs #9769
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Base automatically changed from
ui/feature/permissions-2
to
ui/feature/permissions
February 18, 2021 18:27
added 14 commits
February 18, 2021 18:30
johncowen
force-pushed
the
ui/feature/permissions-3
branch
from
d114118 to
684aeef
Compare
johncowen
added a commit
that referenced
this pull request
Feb 19, 2021
* WIP * Move authorize to the permissions adapter * Slight cleanup and add Resources everywhere * Show a login on the 403 error page * Change to use authorizeBySlug * Add some words around namespaces and permissions * Add correct namespace support * Reorganize authorizeBy things so we can use a slug or set of perms * Clean up new repo methods, tweak DataLoader to deal with 403's nicer * Service > Node * Add some acceptance tests around single item access * Add configuration 'segmented' so we can mark things that shouldn't request * Default permissions to [] * Fix up adapter test
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a continuation of #9687 and #9706.
This PR performs a pre-request when viewing individual models that may be restricted via
service_prefix/key_prefixetc. If the request tells us that the user doesn't have access to view the individual model, then we don't even make the request to try to fetch it (which would result in a 403 anyway).If your access is restricted whilst you are viewing a model and we are told that during our blocking queries, then we show a message (similar to when a service is deregistered) but instead of keeping the information in the page, we wipe the page and show you our standard 403 error page (including a link to re-authenticate)
As only certain models require this pre-request check, we've added a
segmentedproperty to all of ourabilities, if this property isfalseno check is ever made as the model cannot be 'segmented'/used with_prefix(such as ACLs).