Create specific permission ui.loginToUi and built-in role ui-minimal

[alexbudarov]

Currently if I create user that is intended to have only REST API access - this user still can login to backoffice UI.

This user can see main screen and all components on the main screen.
He cannot open any screens from menu because he doesn't have menu / screen permissions.
But if he has some entity permissions, or if components in the main screen's initialLayout use native SQL / entityManager to load data - then user will be able to see it, without ability to restrict him.

So it feels that we need to port "login to web/backoffice ui" permission from CUBA. And provide built-in "system-backoffice-minimal" role with one this permission.

Solution

• Specific permission to login to UI - ui.loginToUi
• UiMinimalRole

@ResourceRole(name = "UI: minimal access", code = UiMinimalRole.CODE)
public interface UiMinimalRole {

    String CODE = "ui-minimal";

    @ScreenPolicy(screenIds = "main")
    void main();

    @ScreenPolicy(screenIds = "login")
    @SpecificPolicy(resources = "ui.loginToUi")
    void login();

    @ScreenPolicy(screenIds = "backgroundWorkProgressScreen")
    void backgroundWork();

    @ScreenPolicy(screenIds = "ui_LayoutAnalyzerScreen")
    void layoutAnalyzer();

    @ScreenPolicy(screenIds = "inputDialog")
    void inputDialog();

    @ScreenPolicy(screenIds = "notFoundScreen")
    void notFoundScreen();

    @ScreenPolicy(screenIds = "selectValueDialog")
    void selectValueDialog();

    @EntityPolicy(entityClass = KeyValueEntity.class, actions = EntityPolicyAction.READ)
    @EntityAttributePolicy(entityClass = KeyValueEntity.class, attributes = "*", action = EntityAttributePolicyAction.VIEW)
    void keyValueEntity();
}

QA

1. Check that user cannot login to UI without ui.loginToUi specific permission.
2. Check that user with ui-minimal role can login to UI.