Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[MODDATAIMP-942] [Poppy] Add missing permissions #309

Closed
wants to merge 10 commits into from
Closed

[MODDATAIMP-942] [Poppy] Add missing permissions #309

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
1dae164
Add missing permission
ncovercash Oct 14, 2023
dd8ebd2
Sync MD
ncovercash Oct 14, 2023
01996bf
Add missing invoice perms
ncovercash Oct 16, 2023
09e46b5
Hide system password in log
ncovercash Oct 16, 2023
8de67ec
test orders invoice assign
ncovercash Oct 17, 2023
e13c1a2
Remove dupe
ncovercash Oct 17, 2023
15655e2
Merge branch 'master' into moddataimp-942
ncovercash Oct 23, 2023
f0aa714
Remove extra code
ncovercash Oct 23, 2023
1a781ec
Merge branch 'master' into moddataimp-942
ncovercash Oct 23, 2023
fee4cea
Remove acq permissions
ncovercash Oct 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion descriptors/ModuleDescriptor-template.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -258,7 +258,9 @@
"instance-authority-links.instances.collection.put",
"instance-authority.linking-rules.collection.get",
"user-tenants.collection.get",
"organizations.organizations.collection.get"
"organizations.organizations.collection.get",
"invoices.acquisitions-units-assignments.assign",
ncovercash marked this conversation as resolved.
Show resolved Hide resolved
"invoices.acquisitions-units-assignments.manage"
],
"permissionsDesired": [
"invoices.acquisitions-units-assignments.assign",
Expand Down
5 changes: 3 additions & 2 deletions src/main/resources/permissions.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,8 +68,6 @@ invoice-storage.invoices.item.put
invoice-storage.invoice-lines.item.post
invoice-storage.invoice-lines.item.put
invoice-storage.invoice-lines.collection.get
acquisitions-units.units.collection.get
acquisitions-units.memberships.collection.get
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These were duplicated elsewhere in the file

orders.po-lines.item.get
orders.po-lines.collection.get
orders-storage.order-invoice-relationships.collection.get
Expand Down Expand Up @@ -101,3 +99,6 @@ instance-authority-links.instances.collection.get
instance-authority-links.instances.collection.put
instance-authority.linking-rules.collection.get
user-tenants.collection.get
organizations.organizations.collection.get
invoices.acquisitions-units-assignments.assign
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it seems that for the data-import system user we should not add this permission as well because data import processes initiated by all other users will be provided with this permission, regardless of whether a user starting the import process has this permission or not.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure what to do, then, since the data import system user operates on the user's behalf to process jobs. Anything the user can do the system user must be able to do

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I haven't come to some solution, but might be we can consider approach of saving "X-Okapi-Permissions" header of the initial user along with the DataImportQueueItem (or smth like that) in the DB. This way, the header could be passed further through Kafka headers and be used by the logic that determines whether the user has this specific permission during invoice creation.

invoices.acquisitions-units-assignments.manage