MODROLESKC-215 Spike - Ability to rename capabilities
Spike Overview
ID: MODROLESKC-215
Objective: Spike - How Okapi handles permission replacement and what Eureka should do to honor this properly.
Background
During a module enabling OKAPI is responsible for providing the permissions from ModuleDescriptor and the corresponding moduleId
to the _tenantPermissions
API provided by mod-permissions
module. Determination of the appropriate actions to be taken is the responsibility of this module. Most of this will happen without explicit or special provisioning in the ModuleDescriptor. Adding, removing or updating the permissions in the permissionsSet
property of ModuleDescriptor is usually sufficient. One exception to that is renaming or replacing one or more permissions / permission sets with another. This is accomplished via the replaces
property on the permission object, e.g.
...
"permissionSets": [
...
{
"permissionName": "tags.item.manage",
"displayName": "Tags - manages tag",
"description": "Manages tags",
"replaces": [ "tags.item.get", "tags.item.post", "tags.item.put", "tags.item.delete" ]
},
...
Scope
Check how permission replacement works in OKAPI
multiple permissions replace one old permission
one permission replaces multiple old permissions
Check how OKAPI handles cases for UI
Does _/self endpoint return old permissions
Does _/self endpoint return new permissions (without direct assignment)
Check how replaces works for permissions sets (permission with sub permissions)
Identify changes required to support replacement functionality by Eureka platform.
Research
Case 1 - Replace multiple permissions with a single permission
Inputs
tags.item.manage
permission replaces four individual permissions:tags.item.get
,tags.item.post
,tags.item.put
,tags.item.delete