MODROLESKC-215 Spike - Ability to rename capabilities

1 Spike Overview
2 Background
3 Scope
4 Research
- 4.1 Case 1 - Replace multiple permissions with a single permission
  - 4.1.1 Inputs
  - 4.1.2 Outputs
- 4.2 Case 2 - Replace permission set with ordinary permissions
  - 4.2.1 Inputs
  - 4.2.2 Outputs
5 Conclusion
6 Attachments

Spike Overview

Objective: Spike - How Okapi handles permission replacement and what Eureka should do to honor this properly.

Background

During a module enabling OKAPI is responsible for providing the permissions from ModuleDescriptor and the corresponding moduleId to the _tenantPermissions API provided by mod-permissions module. Determination of the appropriate actions to be taken is the responsibility of this module. Most of this will happen without explicit or special provisioning in the ModuleDescriptor. Adding, removing or updating the permissions in the permissionsSet property of ModuleDescriptor is usually sufficient. One exception to that is renaming or replacing one or more permissions / permission sets with another. This is accomplished via the replaces property on the permission object, e.g.

...
"permissionSets": [
    ...
    {
      "permissionName": "tags.item.manage",
      "displayName": "Tags - manages tag",
      "description": "Manages tags",
      "replaces": [ "tags.item.get", "tags.item.post", "tags.item.put", "tags.item.delete" ]
    },
    ...

Scope

Check how permission replacement works in OKAPI
- multiple permissions replace one old permission
- one permission replaces multiple old permissions
Check how OKAPI handles cases for UI
- Does _/self endpoint return old permissions
- Does _/self endpoint return new permissions (without direct assignment)
Check how replaces works for permissions sets (permission with sub permissions)
Identify changes required to support replacement functionality by Eureka platform.

Research

Case 1 - Replace multiple permissions with a single permission

Inputs

tags.item.manage permission replaces four individual permissions:
- tags.item.get,
- tags.item.post,
- tags.item.put,
- tags.item.delete

"permissionSets": [
    {
      "permissionName": "tags.collection.get",
      "displayName": "Tags - get tags collection",
      "description": "Get tags collection"
    },
    {
      "permissionName": "tags.item.get",
      "displayName": "Tags - get individual tag from storage",
      "description": "Get individual tag"
    },
    {
      "permissionName": "tags.item.post",
      "displayName": "Tags - create tag",
      "description": "Create tag"
    },
    {
      "permissionName": "tags.item.put",
      "displayName": "Tags - modify tag",
      "description": "Modify tag"
    },
    {
      "permissionName": "tags.item.delete",
      "displayName": "Tags - delete tag",
      "description": "Delete tag"
    },
    {
      "permissionName": "tags.all",
      "displayName": "Tags module - all permissions",
      "description": "Entire set of permissions needed to use the tags module",
      "subPermissions": [
        "tags.collection.get",
        "tags.item.get",
        "tags.item.post",
        "tags.item.put",
        "tags.item.delete"
      ],
      "visible": false
    }
  ]