From 80111e34cb3e4feff1bbeba965799c7faf518088 Mon Sep 17 00:00:00 2001 From: Huey Date: Wed, 17 Aug 2022 15:20:06 -0700 Subject: [PATCH 01/12] Clean up README.md --- README.md | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 6eea1fac3..28aff03ac 100644 --- a/README.md +++ b/README.md @@ -196,18 +196,15 @@ OSMT optionally supports role-based access, with these roles: - Curator: an OSMT user with a curator role can update but not create RSDs and collections. This role is for someone who would publish and unpublish RSDs and Collections - Viewer: an OSMT user with a viewer role is a logged-in user who can not make modifications to RSDs or Collections. -Role-based access is disabled by default. You can follow these steps to enable it. +Role-based access is disabled by default for the UI (front end) and REST (back end). Use these steps to enable roles. -* Note: if the role value is false, all endpoints will be exposed, make sure to enable this value to use Roles + +Front End: In your [`auth-roles.ts`](ui/src/app/auth/auth-roles.ts) file, configure these values: ```text - BACKEND: application.properties file - app.enableRole=true - - FRONTEND: ui/src/app/auth/auth-roles.ts - export const ENABLE_ROLES = true +export const ENABLE_ROLES = true ``` -In your [`application.properties`](api/src/main/resources/config/application.properties) file, configure these values: +Back End: In your [`application.properties`](api/src/main/resources/config/application.properties) file, configure these values: ``` # Roles settings app.enableRoles=true @@ -216,6 +213,7 @@ osmt.security.role.curator=ROLE_Osmt_Curator osmt.security.role.view=ROLE_Osmt_View osmt.security.scope.read=SCOPE_osmt.read ``` +* NOTE: if app.enableRoles=false, all endpoints will be exposed!! * You can use these values, or you can provide your own based on your own authorization tooling. For Okta, you will need to use the uppercase `ROLE_` prefix on your role. * `read` is a scope, not a role. This is for machine-to-machine access, rather than for authenticated OSMT users. From 63a0f63bc0045f2f4eb35c4282d6fd8afd4ac466 Mon Sep 17 00:00:00 2001 From: Jesus Bautista Date: Fri, 19 Aug 2022 17:35:20 -0500 Subject: [PATCH 02/12] added disable function based on roles --- .../config/application-dev.properties | 2 +- ui/package.json | 1 + ui/src/app/app-routing.module.ts | 8 +++++++- ui/src/app/auth/auth-roles.ts | 14 ++++++++++++- ui/src/app/auth/auth-service.ts | 20 +++++++++++++++++++ .../navigation/abstract-search.component.ts | 5 +++++ .../commoncontrols-mobile.component.html | 2 +- .../navigation/commoncontrols.component.html | 2 +- .../navigation/commoncontrols.component.ts | 6 +++++- ...e-skill-action-bar-vertical.component.html | 2 +- .../manage-rich-skill-action-bar.component.ts | 5 +++++ ui/src/styles.css | 4 ++++ 12 files changed, 64 insertions(+), 7 deletions(-) diff --git a/api/src/main/resources/config/application-dev.properties b/api/src/main/resources/config/application-dev.properties index a17c34ef5..f93cee447 100644 --- a/api/src/main/resources/config/application-dev.properties +++ b/api/src/main/resources/config/application-dev.properties @@ -5,7 +5,7 @@ app.baseUrl=http://localhost:8080 # Spring Boot will serve frontend files via port 8080 # If you are using ng serve to proxy static files built by Angular, set OSMT_FRONT_END_PORT to 4200 -app.frontEndPort=${OSMT_FRONT_END_PORT:8080} +app.frontEndPort=${OSMT_FRONT_END_PORT:4200} app.frontendUrl=http://localhost:${app.frontEndPort} app.security.cors.allowedOrigins=${app.baseUrl},${app.frontendUrl} diff --git a/ui/package.json b/ui/package.json index f52e9721a..30cee87d8 100644 --- a/ui/package.json +++ b/ui/package.json @@ -4,6 +4,7 @@ "scripts": { "ng": "./node_modules/@angular/cli/bin/ng", "start": "./node_modules/@angular/cli/bin/ng serve", + "start-debug": "./node_modules/@angular/cli/bin/ng serve --source-map", "start-hotreload": "./node_modules/@angular/cli/bin/ng serve --live-reload", "build": "./node_modules/@angular/cli/bin/ng build", "build-prod": "./node_modules/@angular/cli/bin/ng build --prod", diff --git a/ui/src/app/app-routing.module.ts b/ui/src/app/app-routing.module.ts index cd268ed65..8ad201127 100644 --- a/ui/src/app/app-routing.module.ts +++ b/ui/src/app/app-routing.module.ts @@ -55,7 +55,10 @@ const routes: Routes = [ {path: "skills/:uuid/duplicate", component: RichSkillFormComponent, canActivate: [AuthGuard], - canDeactivate: [FormDirtyGuard] + canDeactivate: [FormDirtyGuard], + data: { + roles: [OSMT_ADMIN, OSMT_CURATOR] + }, }, // manage skill {path: "skills/:uuid/manage", @@ -126,6 +129,9 @@ const routes: Routes = [ {path: "collections/add-skills", component: AddSkillsCollectionComponent, canActivate: [AuthGuard], + data: { + roles: [OSMT_ADMIN] + }, }, // collections library {path: "collections", diff --git a/ui/src/app/auth/auth-roles.ts b/ui/src/app/auth/auth-roles.ts index 3fe048976..986229d92 100644 --- a/ui/src/app/auth/auth-roles.ts +++ b/ui/src/app/auth/auth-roles.ts @@ -2,4 +2,16 @@ export const OSMT_ADMIN = "ROLE_Osmt_Admin" export const OSMT_CURATOR = "ROLE_Osmt_Curator" -export const ENABLE_ROLES = false +export const ENABLE_ROLES = true + +export const ROLES_AUTHORITY : any = { + SKILL_UPDATE : [OSMT_ADMIN, OSMT_CURATOR], + SKILLS_CREATE : [OSMT_ADMIN, OSMT_CURATOR], + SKILL_PUBLISH : [OSMT_ADMIN], + COLLECTION_CREATE : [OSMT_ADMIN, OSMT_CURATOR], + COLLECTION_PUBLISH : [OSMT_ADMIN], + COLLECTION_UPDATE : [OSMT_ADMIN, OSMT_CURATOR], + COLLECTION_SKILLS_UPDATE : [OSMT_ADMIN] +} + + diff --git a/ui/src/app/auth/auth-service.ts b/ui/src/app/auth/auth-service.ts index cf1e92c48..989f8ffb7 100644 --- a/ui/src/app/auth/auth-service.ts +++ b/ui/src/app/auth/auth-service.ts @@ -1,3 +1,5 @@ +import {ENABLE_ROLES, ROLES_AUTHORITY} from "./auth-roles"; + export const STORAGE_KEY_TOKEN = "OSMT.AuthService.accessToken" export const STORAGE_KEY_RETURN = "OSMT.AuthService.return" export const STORAGE_KEY_ROLE = "OSMT.AuthService.role" @@ -42,4 +44,22 @@ export class AuthService { getRole(): string { return localStorage.getItem(STORAGE_KEY_ROLE) as string } + + isDisabledByRoles(path : string): boolean { + let disabled = true; + const allowedRoles = ROLES_AUTHORITY[path]; + const userRoles = this.getRole()?.split(","); + + if (!ENABLE_ROLES) { + return false; + } + + for (const roles of userRoles) { + if (allowedRoles.indexOf(roles) !== -1) { + disabled = true + } + } + + return disabled + } } diff --git a/ui/src/app/navigation/abstract-search.component.ts b/ui/src/app/navigation/abstract-search.component.ts index db9b50687..8513baaec 100644 --- a/ui/src/app/navigation/abstract-search.component.ts +++ b/ui/src/app/navigation/abstract-search.component.ts @@ -49,4 +49,9 @@ export class AbstractSearchComponent { return false } + isDisabled(): boolean { + //return this.AuthService.isDisabledByRoles("SKILLS_CREATE"); + return true + } + } diff --git a/ui/src/app/navigation/commoncontrols-mobile.component.html b/ui/src/app/navigation/commoncontrols-mobile.component.html index 51489ee37..f7153cf7c 100644 --- a/ui/src/app/navigation/commoncontrols-mobile.component.html +++ b/ui/src/app/navigation/commoncontrols-mobile.component.html @@ -55,7 +55,7 @@