feat: Introduce a new tool to check permissions on a node#314
Open
dgriffon wants to merge 2 commits into
Open
Conversation
🦜 Chachalog
|
Introduce a new tool for checking permissions on a node.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This tool helps to understand where a given permission is coming from when checked on a given node.
How it works
Input:
principal: username or group, group is identified by the g: prefix
site: global or from a given site
node path: path of the node to check
workspace: live/default
permission: name of the permission to check, leave empty to get all permissions for the given principal/node couple.
Output:
if a permission is provided, the result of a check result of the permission against the node for the provided user.
If the permission is granted, the node / role that bring the permission to the user
If the permission is granted, and the role not found, the tool needs to be improved to catch where the permission is coming from.
A way is to identify the role/node is to put a breakpoint in this method:
https://github.com/Jahia/jahia-private/blob/4a2f6dffe558040058db84b427ae6cef4f2ada0e/core/src/main/java/org/jahia/utils/security/AccessManagerUtils.java#L428
in the
return truestatements.The tool display also all permissions granted/deny to the provided node and user/group.
Tests