Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

XWIKI-20907: Introduce the notion of required rights #3285

Merged
merged 15 commits into from
Nov 13, 2024
Merged

XWIKI-20907: Introduce the notion of required rights #3285

merged 15 commits into from
Nov 13, 2024

Conversation

michitux
Copy link
Contributor

@michitux michitux commented Jul 19, 2024 •
edited
Loading

Jira URL

https://jira.xwiki.org/browse/XWIKI-20907

Changes

Description

  • Add a new flag to XWikiDocument if required rights shall be enforced.
  • Add the new flag to the filter stream and XAR APIs, increase the XAR version and adapt tests.
  • Add the new flag to the REST API.
  • Add the new flag to the edit form to support updating it.
  • Add a DocumentRequiredRightsManager API to allow getting the required rights that are set on a document.
  • Add a DocumentAuthorizationManager to check rights using required rights.
  • Restrict edit right to users that have all required rights.

TODO:

  • Add tests
  • Fix the resolving of implied rights
  • Add at least some UI, even if initially only for advanced users
  • Integrate required right checking into the contextual authorization manager for script and programming right.
  • Change as many existing right checks as possible to take document rights into account (e.g., UIX, translations, …)
  • Try to find a way to take required rights into account when saving documents with script rights
  • Address the remaining TODOs in the new code
  • Add a cache for required rights (in DocumentRequiredRightsManager)
  • Change the versions to 16.10.0RC1 as this is not ready for 16.6.0.
  • Add a mandatory class initializer for the XWiki.RequiredRightClass

Clarifications

Screenshots & Video

Executed Tests

Ran tests on all modules with code changes without quality profile (coverage is not met currently, this will be fixed).

Expected merging strategy

  • Prefers squash: No, these are huge changes. I tried to group them into somewhat meaningful commits and I would prefer to keep them separated. I squashed fix-only commits into the respective original commits. No backport is planned, so this shouldn't complicate anything.
  • Backport on branches:
    • None, this is a quite breaking new feature.

@michitux michitux force-pushed the XWIKI-20907-2 branch 2 times, most recently from d47e664 to f07a919 Compare August 29, 2024 16:10
@michitux
XWIKI-20907: Introduce the notion of required rights
ad5990c 
* Add a new flag to XWikiDocument if required rights shall be enforced.
* Add the new flag to the filter stream and XAR APIs, increase the XAR
  version and adapt tests.
* Add the new flag to the REST API.
* Add the new flag to the edit form to support updating it.
* Add a DocumentRequiredRightsManager API to allow getting the required
  rights that are set on a document.
* Add a DocumentAuthorizationManager to check rights using required
  rights.
* Restrict edit right to users that have all required rights.
* Add a test for DocumentRequiredRightsReader.
@michitux
XWIKI-20907: Introduce the notion of required rights
3ae1583 
* Add the enforce required rights flag to the document merge.
@michitux
XWIKI-20907: Introduce the notion of required rights
2a9eac4 
* Add tests to the authorization modules.
* Integrate required rights into the authorization integration test
frameworks.
@michitux
XWIKI-20907: Introduce the notion of required rights
d3a8cb1 
* Integrate required rights into the contextual authorization manager.
@michitux
XWIKI-20907: Introduce the notion of required rights
cac950d 
* Start migrating to DocumentAuthorizationManager where necessary.
* Add DocumentAuthorizationManager to MockitoOldcore.
@michitux
XWIKI-20907: Introduce the notion of required rights
2c4ac1a 
* Use the document authorization manager in wiki UI extensions.
@michitux
XWIKI-20907: Introduce the notion of required rights
3057005 
* Fix tests.
* Use the document authorization manager in more places.
* Adapt tests to the document authorization manager.
* ContextualAuthorizationManager: Deny access when required rights
cannot be loaded.
* Fix checkstyle in WikiUIExtensionComponentBuilder.
@michitux
XWIKI-20907: Introduce the notion of required rights
8325a23 
* Introduce a helper in XWikiContext to get the secure document.
@michitux
XWIKI-20907: Introduce the notion of required rights
51fdc8d 
* AuthServiceScriptService: use the document authorization manager.
@michitux
XWIKI-20907: Introduce the notion of required rights
887b8b0 
* Move DocumentRequiredRightsReader to oldcore so it can be used in
  oldcore.
@michitux
XWIKI-20907: Introduce the notion of required rights
025bc05 
* Check rights when modifying documents or objects and when saving
  documents.
@michitux
XWIKI-20907: Introduce the notion of required rights
b4b5147 
* Remove the analyzer for the required right object as it doesn't make
sense to take the object into consideration if this is basically where
we store the result of the analysis.
@michitux
XWIKI-20907: Introduce the notion of required rights
fbbde1f 
* Change the entity type of programming right in the required rights
analysis result to be `null`, i.e., the farm as programming right only
exists on the farm level. Adapt the tests that expected a different
value.
@michitux
XWIKI-20907: Introduce the notion of required rights
d5a7285 
* Fix page tests by moving DefaultDocumentRequiredRightsManager to
  oldcore so the implementation is available to tests that use the
  Document script API.
* Replace the XWiki.RequiredRightClass document by a mandatory document
  initializer.
@michitux
XWIKI-20907: Introduce the notion of required rights
74e1f1d 
* Add a method to api.Document to get the required rights
* Add a method to convert to RequiredRight to a DocumentRequiredRight.
@michitux michitux marked this pull request as ready for review November 13, 2024 15:12
@michitux
Copy link
Contributor Author

The UI has been postponed to ensure that the API ends up in 16.10.x LTS branch, so extensions can start using the flag to enforce required rights on their extension documents. I created https://jira.xwiki.org/browse/XWIKI-22656 for the UI.

The cache that is mentioned in the PR description will be added after the merge.

@michitux michitux merged commit 149a7c1 into xwiki:master Nov 13, 2024
1 check passed
@michitux michitux deleted the XWIKI-20907-2 branch November 13, 2024 16:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tmortagne tmortagne tmortagne left review comments

Assignees

@michitux michitux

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@michitux @tmortagne