Barts-Life-Science / AzureTRE

An accelerator to help organizations build Trusted Research Environments on Azure.
https://microsoft.github.io/AzureTRE
MIT License
0 stars 0 forks source link

RBAC-2: How does the UI know which version of a template to use? #166

Open TonyWildish-BH opened 6 days ago

TonyWildish-BH commented 6 days ago

Goals:

  1. Understand how the UI knows which version of a template to use at the moment
  2. Explore mechanisms to extend this to allow more choice/control
  3. Propose a method to allow a TRE Admin to allow/deny access to a template for each workspace, individually.

When a resource (workspace, workspace service, shared service...) template is registered, an additional boolean flag, current, is set to true or false, to tell the UI if this version can be used or not (see below). Setting this flag to false will hide the template from the UI, setting it to true will allow it to be selected.

N.B. The UI is model-driven, the models are in ui/app/src/models. Within that directory, the current flag is in the resourceTemplate.ts file.

Capture-10

Question 1 One thing to understand is what happens if there are two versions of a template installed. Can they both have their current flag set to true, or can only one be true at a time? If both are true, how does this present itself to the user, how do they choose which to use?

Question 2 When a template is instantiated, the instantiated object gets more metadata added to it, such as an availableUpgrades flag. How is that driven, what updates it, and how? How is it used? How does this whole ui/app/src/models stuff work?

Question 3 What we want, ultimately, for the TRE Admin, is that each workspace has a list of services and an array of allowed versions of each service. The TRE Admin can edit that list of allowed versions, to hide versions from each workspace. This allows a) deprecating older versions, and b) protecting new versions from being used until they've been tested in isolation.

N.B. We clearly want a UI for the TRE Admin to be able to control this, but this will have to go via an API, so we can focus on the API first.