POC: Configurable authorization

.env

@@ -129,3 +129,17 @@ CLIENT_PULL_STRATEGY_INTERVAL=90000
 CLIENT_COLOR_SCHEME='{"type":"library","lat":56.0,"lng":10.0}'
 CLIENT_DEBUG=false
 ###< Client configuration ###
+
+# TODO: Write documentation.
+# See src/Security/Voter/AuthorizationVoterValues.php for complete default authorization array.
+# Example value:
+# AUTHORIZATION_OVERRIDE='{
+#   "SCREEN": {
+#     "LIST": ["ROLE_EDITOR"],
+#     "VIEW": ["ROLE_EDITOR"],
+#     "EDIT": ["ROLE_ADMIN"],
+#     "CREATE": ["ROLE_ADMIN"],
+#     "DELETE": ["ROLE_ADMIN"],
+#   }
+# }'
+AUTHORIZATION_OVERRIDE='{}'

assets/admin/app.jsx

@@ -70,7 +70,7 @@ function App() {
       roles: ["ROLE_ADMIN"],
     },
     screen: {
-      roles: ["ROLE_ADMIN"],
+      roles: ["ROLE_EDITOR", "ROLE_ADMIN"],
     },
     settings: {
       roles: ["ROLE_ADMIN"],

assets/admin/components/restricted-route.jsx

@@ -17,6 +17,9 @@ function RestrictedRoute({ children, roles }) {
   const userHasRequiredRole = context.selectedTenant.get?.roles.find((value) =>
     roles.includes(value),
   );
+
+  console.log("asd", roles, userHasRequiredRole, context.selectedTenant.get?.roles);
+
   if (context.authenticated.get && !userHasRequiredRole) {
     return <NoAccess />;
   }

assets/admin/components/screen/screen-form.jsx

@@ -83,6 +83,32 @@ function ScreenForm({
     previewOrientationOptions[0].value,
   );
 
+  const hasPermission = (entity, action) => {
+    console.log("hasPermission", entity, action);
+
+    if (config?.authorization) {
+      const currentTenant = JSON.parse(localStorage.getItem("admin-selected-tenant"));
+      const userRoles = currentTenant?.roles;
+
+      const authorization = config.authorization;
+
+      console.log("authorization", authorization);
+
+      const requiredRoles = authorization[entity]?.[action];
+
+      console.log("requiredRoles", requiredRoles);
+
+      const intersect = requiredRoles.filter(value => userRoles.includes(value));
+
+      console.log("intersect", intersect);
+
+      if (intersect.length > 0) {
+        return true;
+      }
+    }
+    return false;
+  }
+
   /**
    * Check if published is set
    *
@@ -382,24 +408,28 @@ function ScreenForm({
           >
             {t("cancel-button")}
           </Button>
-          <Button
-            variant="outline-primary"
-            type="button"
-            className="margin-right-button"
-            id="save_screen"
-            onClick={() => checkInputsHandleSubmit(false)}
-          >
-            {t("save-button")}
-          </Button>
-          <Button
-            variant="primary"
-            type="button"
-            onClick={() => checkInputsHandleSubmit(true)}
-            id="save_slide_an_close"
-            className="margin-right-button"
-          >
-            {t("save-button-and-close")}
-          </Button>
+          {hasPermission("Screen", "EDIT") && (
+            <>
+              <Button
+                variant="outline-primary"
+                type="button"
+                className="margin-right-button"
+                id="save_screen"
+                onClick={() => checkInputsHandleSubmit(false)}
+              >
+                {t("save-button")}
+              </Button>
+              <Button
+                variant="primary"
+                type="button"
+                onClick={() => checkInputsHandleSubmit(true)}
+                id="save_slide_an_close"
+                className="margin-right-button"
+              >
+                {t("save-button-and-close")}
+              </Button>
+            </>
+          )}
           {config?.enhancedPreview && (
             <Button
               variant="success"

config/api_platform/feed.yaml

@@ -6,6 +6,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "FEED", object: object})'
                 openapiContext:
                     operationId: get-feeds-id
                     description: Retrieves a feed resource.
@@ -32,6 +33,7 @@ resources:
             _api_Feed_get_data:
                 class: ApiPlatform\Metadata\Get
                 method: GET
+                security: 'is_granted("VIEW", {type: "FEED", object: object})'
                 uriTemplate: '/feeds/{id}/data'
                 read: false
                 controller: App\Controller\Api\FeedGetDataController
@@ -69,6 +71,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "FEED", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'

config/api_platform/feed_source.yaml

@@ -7,6 +7,7 @@ resources:
         processor: App\State\FeedSourceProcessor
         operations:
             ApiPlatform\Metadata\Get: &ref_0
+                security: 'is_granted("VIEW", {type: "FEED_SOURCE", object: object})'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
@@ -30,7 +31,9 @@ resources:
                                 application/ld+json:
                                     examples: null
                             headers: {}
+
             _api_Feed_get_source_config:
+                security: 'is_granted("VIEW", {type: "FEED_SOURCE", object: object})'
                 class: ApiPlatform\Metadata\Get
                 method: GET
                 uriTemplate: '/feed-sources/{id}/config/{name}'
@@ -67,7 +70,9 @@ resources:
                                                   id: id1
                                                   value: value1
                             headers: {}
+
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "FEED_SOURCE", object: object})'
                 filters:
                     - entity.search_filter
                     - entity.blameable_filter
@@ -97,7 +102,7 @@ resources:
                           description: The number of items per page
                         - schema:
                               type: string
-                          pattern: '^[A-Za-z0-9]*$'
+                              pattern: '^[A-Za-z0-9]*$'
                           name: supportedFeedOutputType
                           in: query
                     responses:
@@ -107,8 +112,9 @@ resources:
                                 application/ld+json:
                                     examples: null
                             headers: {}
+
             ApiPlatform\Metadata\Put:
-                security: is_granted("ROLE_ADMIN")
+                security: 'is_granted("EDIT", {type: "FEED_SOURCE", object: object})'
                 openapiContext:
                     description: Update a Feed Source resource.
                     summary: Update a Feed Source resource.
@@ -123,8 +129,9 @@ resources:
                           name: id
                           in: path
                           required: true
+
             ApiPlatform\Metadata\Delete:
-                security: is_granted("ROLE_ADMIN")
+                security: 'is_granted("DELETE", {type: "FEED_SOURCE", object: object})'
                 openapiContext:
                     description: Delete a Feed Source resource.
                     summary: Delete a Feed Source resource.
@@ -139,15 +146,18 @@ resources:
                           name: id
                           in: path
                           required: true
+
             ApiPlatform\Metadata\Post:
-                security: is_granted("ROLE_ADMIN")
+                security: 'is_granted("CREATE", {type: "FEED_SOURCE", object: object})'
                 openapiContext:
                     operationId: create-v2-feed-source
                     description: Creates a Feed Source resource.
                     summary: Creates a Feed Source resource.
                     tags:
                         - FeedSources
+
             '_api_/feed_sources/{id}/slides_get': &ref_1
+                security: 'is_granted("LIST", {type: "FEED_SOURCE_SLIDES", object: object})'
                 normalizationContext:
                     groups:
                         - 'playlist-slide:read'
@@ -164,7 +174,7 @@ resources:
                 uriTemplate: '/feed-sources/{id}/slides'
                 openapiContext:
                     description: Retrieves collection of weighted slide resources (feedsource).
-                    summary: Retrieves collection of weighted slide resources  (feedsource).
+                    summary: Retrieves collection of weighted slide resources (feedsource).
                     operationId: get-v2-feed-source-slide-id
                     tags:
                         - FeedSources

config/api_platform/layout.yaml

@@ -6,6 +6,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "LAYOUT", object: object})'
                 uriTemplate: '/layouts/{id}'
                 normalizationContext:
                     jsonld_embed_context: true
@@ -32,6 +33,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "LAYOUT", object: object})'
                 uriTemplate: '/layouts'
                 openapiContext:
                     description: Retrieve a collection of layouts resources.

config/api_platform/media.yaml

@@ -7,6 +7,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "MEDIA", object: object})'
                 uriTemplate: '/media/{id}'
                 normalizationContext:
                     jsonld_embed_context: true
@@ -33,6 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Delete:
+                security: 'is_granted("DELETE", {type: "MEDIA", object: object})'
                 openapiContext:
                     description: Delete a Media resource.
                     summary: Delete a Media resource.
@@ -49,6 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "MEDIA", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
@@ -84,6 +87,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Post:
+                security: 'is_granted("CREATE", {type: "MEDIA", object: object})'
                 controller: App\Controller\Api\MediaController
                 deserialize: false
                 normalizationContext:

config/api_platform/playlist.yaml

@@ -10,6 +10,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "PLAYLIST", object: object})'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
@@ -35,6 +36,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
+                security: 'is_granted("EDIT", {type: "PLAYLIST", object: object})'
                 openapiContext:
                     description: Update a Playlist resource.
                     summary: Update a Playlist resource.
@@ -51,6 +53,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
+                security: 'is_granted("DELETE", {type: "PLAYLIST", object: object})'
                 openapiContext:
                     description: Delete a Playlist resource.
                     summary: Delete a Playlist resource.
@@ -67,6 +70,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "PLAYLIST", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
@@ -100,6 +104,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Post:
+                security: 'is_granted("CREATE", {type: "PLAYLIST", object: object})'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:

config/api_platform/playlist_screen_region.yaml

@@ -1,12 +1,11 @@
 ---
 resources:
     App\Entity\Tenant\PlaylistScreenRegion:
-        security: 'is_granted("ROLE_SCREEN") or is_granted("ROLE_ADMIN")'
         output: App\Dto\PlaylistScreenRegion
 
         operations:
-            # prettier-ignore
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "PLAYLIST_SCREEN_REGION", object: object})'
                 # It needs to be here to generate ids in the collection lists.
                 uriTemplate: '/playlist-screen-regions/{id}'
                 controller: App\Controller\Api\NotFoundAction
@@ -15,7 +14,7 @@ resources:
                     operationId: getPlaylistScreenRegionItem
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", {type: "PLAYLIST_SCREEN_REGION", object: object})'
                 uriTemplate: '/screens/{id}/regions/{regionId}/playlists/{playlistId}'
                 controller: App\Controller\Api\PlaylistScreenRegionDeleteController
                 read: false
@@ -52,7 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", {type: "PLAYLIST_SCREEN_REGION", object: object})'
                 uriTemplate: '/screens/{id}/regions/{regionId}/playlists'
                 controller: App\Controller\Api\PlaylistScreenRegionPutController
                 read: false
@@ -104,6 +103,7 @@ resources:
                             description: 'Not found'
 
             ApiPlatform\Metadata\GetCollection: &get_collection
+                security: 'is_granted("LIST", {type: "PLAYLIST_SCREEN_REGION", object: object})'
                 normalizationContext:
                     groups: ['playlist-screen-region:read']
                 provider: App\State\PlaylistScreenRegionProvider