Skip to content

Next

  • Projects
  • Groups
  • Snippets
  • Help
    • Loading...
    • Help
    • Support
    • Submit feedback
    • Contribute to GitLab
    • Switch to GitLab Next
  • Sign in / Register
Minds Backend - Engine
Minds Backend - Engine
  • Project
    • Project
    • Details
    • Activity
    • Releases
    • Cycle Analytics
    • Insights
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
    • Charts
    • Locked Files
  • Issues 206
    • Issues 206
    • List
    • Boards
    • Labels
    • Service Desk
    • Milestones
  • Merge Requests 29
    • Merge Requests 29
  • CI / CD
    • CI / CD
    • Pipelines
    • Jobs
    • Schedules
    • Charts
  • Packages
    • Packages
    • List
    • Container Registry
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Members
    • Members
  • Collapse sidebar
  • Activity
  • Graph
  • Charts
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
  • Minds
  • Minds Backend - EngineMinds Backend - Engine
  • Merge Requests
  • !290

Open
Opened 4 days ago by Brian Hatchet@brianhatchet:speech_balloon:
  • Report abuse
Report abuse

(feat) permissions rbac 600

Dynamic calculation of Mind's entities using flags defined in Zend's RBAC framework

Just the roles right now, will be adding permissions as we go.

Setup a new manager that takes a user and a list of entities.

Based on the user's relationship to the entity, it will return a Role object with all the derived flags

It returns a Permissions object which contains the Channels and the user's role within that channel Groups and the user's role within that group The entities themselves and the user's role for that entity

Full exportable as json on /v2/permissions/roles/{user guid}?guids[]=entity_guid&guids[]=entity_guid

Edited 2 days ago by Brian Hatchet

Check out, review, and merge locally

Step 1. Fetch and check out the branch for this merge request

git fetch origin
git checkout -b feature/permissions-rbac-600 origin/feature/permissions-rbac-600

Step 2. Review the changes locally

Step 3. Merge the branch and fix any conflicts that come up

git fetch origin
git checkout origin/epic/permissions-open-channels
git merge --no-ff feature/permissions-rbac-600

Step 4. Push the result of the merge to GitLab

git push origin epic/permissions-open-channels

Note that pushing to GitLab requires write access to this repository.

Tip: You can also checkout merge requests locally by following these guidelines.

Request to merge feature/permissions-rbac-600 into epic/permissions-open-channels
Open in Web IDE
  • Email patches
  • Plain diff
Pipeline #75491124 passed for 1111178b on feature/permissions-rbac-600
          Requires 2 more approvals from Devs and Deployers.
          Marcelo Rivera
          Marcelo Rivera
          Rami Albatal
          Rami Albatal
          Emiliano Balbuena
          Emiliano Balbuena
          Martin Santangelo
          Martin Santangelo
          Mark Harding
          Mark Harding
          Ready to be merged automatically. Ask someone with write access to this repository to merge this request

          Deletes source branch

          • Discussion 20
          • Commits 8
          • Pipelines 4
          • Changes 31
          7/11 threads resolved
          • Loading...
          • Brian Hatchet :speech_balloon: @brianhatchet changed milestone to %sprint: Kilted Koala 4 days ago

            changed milestone to %sprint: Kilted Koala

          • Brian Hatchet :speech_balloon: @brianhatchet added Squad::Green scoped label 4 days ago

            added Squad::Green scoped label

          • Brian Hatchet :speech_balloon: @brianhatchet added 19 commits 3 days ago

            added 19 commits

            • a362a518 - [Sprint/HipsterHedgehog] (fix): update thumbnails in activities
            • 4f0eea59 - Merge branch 'fix/update-thumbnails-in-activities' into 'master'
            • b14691c5 - [Sprint/GiddyGiraffe] (feat): ability for channels to self-declare nsfw
            • b50c93d2 - Merge branch 'feat/self-declare-nsfw' into 'master'
            • 84da7d65 - Sprint/JollyJellyfish: Filtering banned and deleted channels
            • ef53036e - Merge branch 'fix/banned-suggested-channels-381' into 'master'
            • f0a0a925 - Fixed forgot password validation
            • 83d701b4 - Merge branch 'forgot-password-validation-fix-560' into 'master'
            • bbf41c60 - [Sprint/CleverChipmunk] (feat): ability to disable group conversations
            • 5845f667 - Merge branch 'feat/disable-group-convos' into 'master'
            • 14927878 - [Sprint/KiltedKoala] (fix): groups conversations issue
            • 07015d77 - Merge branch 'fix/groups-conversation-issue' into 'master'
            • dffd0a4e - (feat): introduce new mwa endpoint for pageview recording
            • d14ac69a - (chore): change boost existing check to include approved too
            • e0140852 - (revert): d14ac69a -> also includes revoked and completed"
            • 3b7aafa9 - (chore): reduce boost offset to 2.5 minutes
            • c5d27f85 - (fix): comment on reminds should not go to remind_object
            • 9bd4d314 - (fix): correct labels for gitlab runners
            • 526aae86 - Merge remote-tracking branch 'origin/master' into feature/permissions-rbac-600

            Compare with previous version

            Toggle commit list
          • Mark Harding
            Mark Harding @markeharding started a thread on an old version of the diff 3 days ago
            Resolved by Brian Hatchet 2 days ago
          • Mark Harding
            Mark Harding @markeharding started a thread on an old version of the diff 3 days ago
            Resolved by Brian Hatchet 2 days ago
          • Brian Hatchet :speech_balloon: @brianhatchet added 1 commit 2 days ago

            added 1 commit

            • 3b020fa8 - Feature complete, role parsing for groups and channels.

            Compare with previous version

          • Brian Hatchet :speech_balloon: @brianhatchet resolved all threads 2 days ago

            resolved all threads

          • Brian Hatchet :speech_balloon: @brianhatchet unmarked as a Work In Progress 2 days ago

            unmarked as a Work In Progress

          • Brian Hatchet :speech_balloon: @brianhatchet changed title from WIP: Feature/permissions rbac 600 to (feat) permissions rbac 600 2 days ago

            changed title from WIP: Feature/permissions rbac 600 to (feat) permissions rbac 600

          • Brian Hatchet :speech_balloon: @brianhatchet changed the description 2 days ago

            changed the description

          • Ben Hayward
            Ben Hayward @benhayward.ben started a thread on an old version of the diff 1 day ago
            Resolved by Brian Hatchet 1 day ago
          • Ben Hayward
            Ben Hayward @benhayward.ben started a thread on an old version of the diff 1 day ago
            Resolved by Brian Hatchet 1 day ago
          • Ben Hayward
            Ben Hayward @benhayward.ben started a thread on an old version of the diff 1 day ago
            Resolved by Brian Hatchet 1 day ago
          • Ben Hayward
            Ben Hayward @benhayward.ben started a thread on an old version of the diff 1 day ago
            Resolved by Brian Hatchet 1 day ago
          • Ben Hayward @benhayward.ben added MR::Requires Changes scoped label 1 day ago

            added MR::Requires Changes scoped label

          • Brian Hatchet :speech_balloon: @brianhatchet resolved all threads 1 day ago

            resolved all threads

          • Brian Hatchet :speech_balloon: @brianhatchet added 1 commit 1 day ago

            added 1 commit

            • 1111178b - CR updates

            Compare with previous version

          • Emiliano Balbuena
            Emiliano Balbuena @edgebal started a thread on the diff 20 hours ago
            Last updated by Brian Hatchet 20 hours ago
            Core/Permissions/Delegates/BaseRoleCalculator.php
            3 namespace Minds\Core\Permissions\Delegates;
            4
            5 use Minds\Core\Permissions\Roles\Roles;
            6 use Minds\Entities\User;
            7
            8 abstract class BaseRoleCalculator
            9 {
            10 /** @var Roles */
            11 protected $roles;
            12 /** @var User */
            13 protected $user;
            14
            15 public function __construct(User $user, Roles $roles = null)
            16 {
            17 $this->roles = $roles ?: new Roles();
            18 $this->user = $user;
            • Emiliano Balbuena
              Emiliano Balbuena @edgebal · 20 hours ago
              Developer

              We're using __construct as DI (either instances or constant values). $this->user should be set by a setUser(User $user) setter.

            • Brian Hatchet
              Brian Hatchet :speech_balloon: @brianhatchet · 20 hours ago
              Developer

              Ehh, I get that's our paradigm, but I think this is an appropriate user of setting forcing the permissions object to be contextualized to the user. This object will be popping up like kudzu and I'd rather make it hard to change the user per instance. I'll await @markeharding 's final ruling

            • Please register or sign in to reply
          • Emiliano Balbuena
            Emiliano Balbuena @edgebal started a thread on the diff 20 hours ago
            Last updated by Brian Hatchet 20 hours ago
            Core/Permissions/Delegates/GroupRoleCalculator.php
            7 use Minds\Core\Permissions\Roles\Roles;
            8 use Minds\Core\EntitiesBuilder;
            9 use Minds\Entities\User;
            10
            11 class GroupRoleCalculator extends BaseRoleCalculator
            12 {
            13 use MagicAttributes;
            14
            15 /** @var EntitiesBuilder */
            16 private $entitiesBuilder;
            17 /** @var array */
            18 private $groups = [];
            19
            20 public function __construct(User $user, Roles $roles, EntitiesBuilder $entitiesBuilder = null)
            21 {
            22 parent::__construct($user, $roles);
            • Emiliano Balbuena
              Emiliano Balbuena @edgebal · 20 hours ago
              Developer

              As stated in the comments above, $this->user should be handled by a setter.

            • Brian Hatchet
              Brian Hatchet :speech_balloon: @brianhatchet · 20 hours ago
              Developer

              knife fight

            • Please register or sign in to reply
          • Emiliano Balbuena
            Emiliano Balbuena @edgebal started a thread on the diff 20 hours ago
            Resolved by Brian Hatchet 20 hours ago
          • Emiliano Balbuena
            Emiliano Balbuena @edgebal started a thread on the diff 20 hours ago
            Core/Permissions/Manager.php
            32 $opts = array_merge([
            33 'user_guid' => null,
            34 'guids' => [],
            35 ], $opts);
            36
            37 if ($opts['user_guid'] === null) {
            38 throw new \InvalidArgumentException('user_guid is required');
            53 39 }
            54 40
            55 foreach ($this->db->getRow('activity:entitylink:'.$entity->getGUID()) as $parentGuid => $ts) {
            56 $activity = $this->entitiesBuilder->single($parentGuid);
            57 $activity->setAllowComments($permissions->getAllowComments());
            58 $this->save
            59 ->setEntity($activity)
            60 ->save();
            41 $user = $this->entitiesBuilder->single($opts['user_guid']);
            • Emiliano Balbuena
              Emiliano Balbuena @edgebal · 20 hours ago
              Developer

              Just a note here: If we're using the user as a GUID placeholder (just to check subscriptions). I think that you might be able to just do:

              $user = new User();
              $user->set('guid', $opts['user_guid']);

              This is ONLY if you're NOT using '->username', '->admin', '->banned', etc.

            • Please register or sign in to reply
          • Emiliano Balbuena
            Emiliano Balbuena @edgebal started a thread on the diff 20 hours ago
            Core/Permissions/Permissions.php
            26 private $entities;
            27 /** @var ChannelRoleCalculator */
            28 private $channelRoleCalculator;
            29 /** @var GroupRoleCalculator */
            30 private $groupRoleCalculator;
            31
            32 public function __construct(User $user, Roles $roles = null, EntitiesBuilder $entitiesBuilder)
            33 {
            34 $this->roles = $roles ?: new Roles();
            35 $this->user = $user;
            36 $this->isAdmin = $user->isAdmin();
            37 $this->isBanned = $user->isBanned();
            38 $this->groups = [];
            39 $this->channels = [];
            40 $this->entities = [];
            41 $this->channels[$user->getGUID()] = $user;
            • Emiliano Balbuena
              Emiliano Balbuena @edgebal · 20 hours ago
              Developer

              $this->user should be provided via setter. Both here and in the calculators. On the calculators, I think they should be set on-the-fly before the calculation happens.

            • Please register or sign in to reply
          • You're only seeing other activity in the feed. To add a comment, switch to one of the following options.
          Please register or sign in to reply
          Assignee
          Brian Hatchet's avatar Brian Hatchet @brianhatchet
          Assign to
          sprint: Kilted Koala
          Milestone
          sprint: Kilted Koala
          Assign milestone
          None
          Time tracking
          No estimate or time spent
          2
          Labels
          MR::Requires Changes Squad::Green
          Assign labels
          • View project labels
          Lock merge request
          Unlocked
          7
          7 participants
          user avatar
          Marcelo Rivera
          user avatar
          Rami Albatal
          user avatar
          Emiliano Balbuena
          user avatar
          Martin Santangelo
          user avatar
          Mark Harding
          user avatar
          Ben Hayward
          user avatar
          Brian Hatchet
          Reference: minds/engine!290