Don't use user.manage permission for packet management permission checks#258
Don't use user.manage permission for packet management permission checks#258david-mears-2 wants to merge 2 commits intomrc-6905-show-installed-packagesfrom
Conversation
30f3afe to
b2ec4f3
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## mrc-6905-show-installed-packages #258 +/- ##
====================================================================
- Coverage 99.26% 99.26% -0.01%
====================================================================
Files 203 203
Lines 5889 5887 -2
Branches 983 981 -2
====================================================================
- Hits 5846 5844 -2
Misses 42 42
Partials 1 1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
absternator
left a comment
There was a problem hiding this comment.
The initial idea was to make user.manage kind of like a god permission. As people who can manage users can pretty much do anything in the application. Thus not having to add packet.manage or any other permissions to people who can manage users. As this probably the highest level permission.
The issue here is if they want to add permissions to a user with packets but dont have the manage permission then they cant add those permissions. Beacuse pretty sure they wont see the list of packets and packet groups anymore when updating permissions. This is not right: a user with user.manage should be able to add/remove any permission to a user without needing packet.manage. See screenshot below with a new user with only user. manage
canManageAllPacketsis the name of functions that existed both in the front end and the back end, which allow users to manage packets when they have global user.manage permission (including when they don't have packet.manage).We should keep packet management permissions separate from user management, so I have removed this function and replaced it with a reference to
hasGlobalPacketManagePermission.The exception to keeping the two scopes separate is when granting users packet-related permissions; that really is both user management and packet management. It looks like currently these actions are defended only by 'user.manage' (e.g. at the top of RoleController), i.e. through packit I can give someone (myself excluded) permissions for any packet, regardless of whether I have permissions for that packet. This seems OK but I wanted to check.