Make operations permissions required

[Noviny]

When looking at operations permissions, we have observed that this can often be misconfigured.
We additionally don't want to rely on true or false defaults that may be confusing or unexpected to users.

As a result, we are changing access.operations on lists to be explicitly required.

The basic change is the following:

- list({
-   access?: {
-     operation?: {
-       query?: ({ session, context, listKey, operation }) => boolean,
-       create?: ({ session, context, listKey, operation }) => boolean,
-       update?: ({ session, context, listKey, operation }) => boolean,
-       delete?: ({ session, context, listKey, operation }) => boolean,
-     }
-     ...
-   },
-   ...
- })
+ list({
+   access: {
+     operation: {
+       query: ({ session, context, listKey, operation }) => boolean,
+       create: ({ session, context, listKey, operation }) => boolean,
+       update: ({ session, context, listKey, operation }) => boolean,
+       delete: ({ session, context, listKey, operation }) => boolean,
+     }
+     ...
+   },
+   ...
+ })

To make this a bit easier however, we are adding two new options.

list({
  access: ({ session, context, listKey, operation }) => boolean
  ...
})

allows you to set all access controls at once, and

list({
  access: {
    operations: ({ session, context, listKey, operation }) => boolean,
    ...
  },
  ...
});

allows you to set all operations access controls for a list at once.

New exports

We are providing three new helper exports to help out with this change so you can have code that reads well:

import { allowAll, denyAll, allOperations } from "@keystone-6/core/access"

These functions should allow quickly applying access controls to lists. For example, to get the existing default access controls, you could do:

list({
  access: allowAll,
  ...
});

or

list({
  access: allowAll,
  ...
});

list({
  access: { operations: allowAll },
  ...
});

If you were setting access for create operations, you can quickly update to:

list({
  access: { operations: { ...allOperations(allowAll), create: myCustomCreateAccessCheck } },
  ...
});

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated
keystone-next-docs	✅ Ready (Inspect)	Visit Preview	Aug 31, 2022 at 7:49AM (UTC)

[Noviny]

Commit history should be a good guide here in understanding actual changes vs updating all our various configs to comply with the change.

TODO:

• update docs to reflect the new reality
• changeset

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit 18c9db2:

Sandbox	Source
@keystone-6/sandbox	Configuration