Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add possibility to set "required" RBAC conditions #10185

Merged
merged 5 commits into from
May 10, 2021

Conversation

Convly
Copy link
Member

@Convly Convly commented Apr 29, 2021

What does it do?

Add a new willRegister hook for the permission engine. This hook exposes a context which allow to add raw conditions to the permission.

A handler for this hook would then be able to add condition with or / and logic to the final permission
Example:

const handler = context => {
  const { permission, condition, user } = context;

  // ...

  condition
    .and({
      foo: {
        $in: ['bar', 'foobar'],
      }
    })
    .or({ bar: 'foo' });
}

All conditions added with an and are required to pass for the condition to be valid, whereas only one of the conditions added with an or need to pass.

Why is it needed?

Currently, all conditions are evaluated with an or logic. It can lead to issues when multiples conditions need to be matched (eg: is-creator (rbac) + has-locale-access (i18n) => if one of the condition is matched, then the other doesn't matter)

Related issue(s)/PR(s)

fix #10159

Notes

I'll submit a PR after this one to add more complete unit tests for the permission engine.

@Convly Convly added issue: enhancement Issue suggesting an enhancement to an existing feature source: core:strapi Source is core/strapi package labels Apr 29, 2021
@codecov
Copy link

codecov bot commented Apr 29, 2021

Codecov Report

Merging #10185 (7f941cd) into master (3198d19) will decrease coverage by 0.03%.
The diff coverage is 64.38%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master   #10185      +/-   ##
==========================================
- Coverage   57.86%   57.82%   -0.04%     
==========================================
  Files         183      184       +1     
  Lines        6348     6393      +45     
  Branches     1392     1395       +3     
==========================================
+ Hits         3673     3697      +24     
- Misses       2215     2233      +18     
- Partials      460      463       +3     
Flag Coverage Δ
front ∅ <ø> (∅)
unit 57.82% <64.38%> (-0.04%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
packages/strapi-admin/domain/condition/index.js 100.00% <ø> (ø)
...s/strapi-admin/services/permission/engine-hooks.js 24.13% <24.13%> (ø)
packages/strapi-admin/services/role.js 94.70% <33.33%> (-1.25%) ⬇️
...n/services/permission/permissions-manager/index.js 95.00% <87.50%> (-2.06%) ⬇️
...ackages/strapi-admin/services/permission/engine.js 96.29% <96.55%> (+5.75%) ⬆️
...es/permission/permissions-manager/query-builers.js 100.00% <100.00%> (ø)
packages/strapi-utils/lib/build-query.js 16.45% <100.00%> (ø)
...ages/strapi-utils/lib/convert-rest-query-params.js 93.82% <100.00%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3198d19...7f941cd. Read the comment docs.

@Convly Convly added the flag: don't merge This PR should not be merged at the moment label Apr 29, 2021
@Convly Convly force-pushed the fix/rbac-conditions-not-acting-as-required branch 2 times, most recently from 1f361f8 to 133d4c5 Compare April 29, 2021 15:50
@alexandrebodin alexandrebodin modified the milestone: 4.0.0 Apr 30, 2021
@Convly Convly force-pushed the fix/rbac-conditions-not-acting-as-required branch from 2354f4d to 4ebb1eb Compare May 3, 2021 13:07
@Convly Convly changed the title Add optional property 'required' to rbac conditions Add possibility to set "required" RBAC conditions May 6, 2021
@Convly Convly force-pushed the fix/rbac-conditions-not-acting-as-required branch from d6691fb to 0cc30da Compare May 6, 2021 16:46
@Convly Convly force-pushed the fix/rbac-conditions-not-acting-as-required branch from 0cc30da to 9c60f66 Compare May 7, 2021 13:48
@Convly Convly requested a review from alexandrebodin May 7, 2021 14:39
Copy link
Member

@alexandrebodin alexandrebodin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@alexandrebodin alexandrebodin added this to the 3.6.2 milestone May 10, 2021
@Convly Convly removed the flag: don't merge This PR should not be merged at the moment label May 10, 2021
@alexandrebodin alexandrebodin merged commit 934a47e into master May 10, 2021
@alexandrebodin alexandrebodin deleted the fix/rbac-conditions-not-acting-as-required branch May 10, 2021 09:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
issue: enhancement Issue suggesting an enhancement to an existing feature source: core:strapi Source is core/strapi package
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Author RBAC not working for collections with i18n
2 participants