Skip to content

feat(lint): expose the user role's security flags #1238

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jvegmond-tech wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(lint): expose the user role's security flags #1238

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .claude/skills/mendix/write-lint-rules/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -497,6 +497,10 @@ Returned by `permissions()` (all types) or `permissions_for()` (entity-specific)
| `name` | string | `"Administrator"` |
| `is_anonymous` | bool | True if this is the anonymous/guest role |
| `module_roles` | list of string | `["Sales.Admin", "HR.Viewer"]` |
| `check_security` | bool | Studio Pro's per-role "Check security" flag |
| `manage_all_roles` | bool | The role may hand out every user role |
| `manage_users_without_roles` | bool | The role may manage users that have no role |
| `manageable_roles` | list of string | The user roles this role may hand out, when not all |

### module_role
| Property | Type | Example |
Expand Down
20 changes: 17 additions & 3 deletions mdl/linter/context.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -485,6 +485,16 @@ type UserRoleInfo struct {
Name string
IsAnonymous bool
ModuleRoles []string
// CheckSecurity is Studio Pro's per-role "Check security" flag. With it on,
// the Modeler verifies that the role's access rules actually grant what its
// pages and microflows need — the setting a rule of the form "security
// should be checked for each project role" asserts.
CheckSecurity bool
// ManageAllRoles, ManageUsersWithoutRoles and ManageableRoles are the
// user-management grants: which other roles this role may hand out.
ManageAllRoles bool
ManageUsersWithoutRoles bool
ManageableRoles []string
}

// UserRoles returns the user roles from project security.
Expand All @@ -501,9 +511,13 @@ func (ctx *LintContext) UserRoles() []UserRoleInfo {
var roles []UserRoleInfo
for _, ur := range ps.UserRoles {
roles = append(roles, UserRoleInfo{
Name: ur.Name,
IsAnonymous: ur.Name == ps.GuestUserRole,
ModuleRoles: ur.ModuleRoles,
Name: ur.Name,
IsAnonymous: ur.Name == ps.GuestUserRole,
ModuleRoles: ur.ModuleRoles,
CheckSecurity: ur.CheckSecurity,
ManageAllRoles: ur.ManageAllRoles,
ManageUsersWithoutRoles: ur.ManageUsersWithoutRoles,
ManageableRoles: ur.ManageableRoles,
})
}
return roles
Expand Down
14 changes: 11 additions & 3 deletions mdl/linter/starlark.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1045,10 +1045,18 @@ func userRoleToStarlark(ur UserRoleInfo) starlark.Value {
for _, mr := range ur.ModuleRoles {
moduleRoles = append(moduleRoles, starlark.String(mr))
}
var manageableRoles []starlark.Value
for _, mr := range ur.ManageableRoles {
manageableRoles = append(manageableRoles, starlark.String(mr))
}
return starlarkstruct.FromStringDict(starlark.String("user_role"), starlark.StringDict{
"name": starlark.String(ur.Name),
"is_anonymous": starlark.Bool(ur.IsAnonymous),
"module_roles": starlark.NewList(moduleRoles),
"name": starlark.String(ur.Name),
"is_anonymous": starlark.Bool(ur.IsAnonymous),
"module_roles": starlark.NewList(moduleRoles),
"check_security": starlark.Bool(ur.CheckSecurity),
"manage_all_roles": starlark.Bool(ur.ManageAllRoles),
"manage_users_without_roles": starlark.Bool(ur.ManageUsersWithoutRoles),
"manageable_roles": starlark.NewList(manageableRoles),
})
}

Expand Down
Loading