We need to correlate group rights with api actions somehow so that the frontend can know when to show actions or screens that are restricted to certain users. We have been doing this so far with custom logic in the frontend that is maintained separately from backend authz. The API is enforcing the backend authz so we are not worried about security so much as trying to improve the user experience. Nobody wants to fill out a lot of form fields and then be told "oops, you can't do that" after submitting.
Description
Description
Details
Details
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| authz: pass authz data to frontend and use in vue | wikimedia/toolhub | main | +615 -146 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | bd808 | T275229 Content moderation support | |||
| Resolved | bd808 | T282186 Pass backend permission information to frontend |
Event Timeline
Comment Actions
What we really want is permission control information on the vue side. I spent some time today looking at https://casl.js.org/v5/en which is an attempt at a "standard" for passing find grained authz rules from a backend to a frontend. I think we could actually use this without too much work. It should be possible to represent the rules that we are using on the backend in CASL. Unfortunately I'm not seeing a simple way to automatically generate the CASL from the existing django-rules config, but the level of expressiveness is equivalent.
Comment Actions
Change 690525 had a related patch set uploaded (by BryanDavis; author: Bryan Davis):
[wikimedia/toolhub@main] authz: pass authz data to frontend and use in vue
Comment Actions
Change 690525 merged by jenkins-bot:
[wikimedia/toolhub@main] authz: pass authz data to frontend and use in vue