-
-
Notifications
You must be signed in to change notification settings - Fork 672
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: frontend access controll #3100
feat: frontend access controll #3100
Conversation
@Kuchenpirat should this still be draft? Looks like some to do items not done as yet. |
Not really a draft, but have to check out the conflicts once i am back home. (Should be easy tho) |
should be good to go again👍 |
thanks @boc-the-git. I have updated the comments to reflect what the middleware is actually doing. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good mate, good enhancements 👍
What type of PR is this?
What this PR does / why we need it:
This PR adds middlewares to all pages that expect the user to be registered / or have special flags enabled (exept the individual cookbook page)
Which issue(s) this PR fixes:
Fixes #3098
Partially Fixes #3083 (frontend only)
Partially Fixes #3049 (frontend only)
Fixes #3082
Special notes for your reviewer:
I had to add the middleware to most pages because the middleware will only affect all sub pages if there is a .vue file on the same level with the same name as the folder (see e.g. /group/data). I don't think it would be a huge problem
This will add frontend restrictions only, we should tighten some backend stuff and check more if the required user flags are set.
The only page that is not included is the page for individual cookbooks. But this would need a custom integration any way as we need to check whether the cookbook is private or not.
This does also disable access to the group settings page for any user that does not have the permission to manage group settings. We could also disable all inputs when the user does not have the right permission. Feedback on this is welcome.
I think this can be merged as it, as this is a substantial improvement and a finished product within itself.
Testing
Manually tested each page with users that should have access to it, and users that should not (if availlable).