Open AlexandrePTJ opened 1 year ago
This would leak the internal data structure of Kimai, my gut feeling tells me we should change that. Can you define your requirements, probably as JSON, so we can create an endpoint that is simpler to use and understand?
Currently one can only retrieve the roles of a user without any of the permissions.
I can understand if not all permissions should be publicly available but the create_team
, create_customer
and create_activity
permissions would atleast be needed on the /api/users/me
endpoint. For our requirements the current user would suffice.
Maybe a /api/roles
endpoint with different amount of returned permissions depending on the current permissions of the user would better fit the general api?
The only way one could currently check the permissions is by sending a invalid request at the create endpoint and checking for a 403. That would be a bit ungraceful though.
Who is behind "our requirements"? I have never see you post here @muxelplexer, so welcome 👋 , but I am intrigued how it comes that you suddenly show up on new issue with an existing requirement.
Ah i'm sorry ^^ I've started working on the permission stuff over on Kemai so i thought i'd give my 2 cents to it :)
Thanks for the welcome
This would leak the internal data structure of Kimai, my gut feeling tells me we should change that. Can you define your requirements, probably as JSON, so we can create an endpoint that is simpler to use and understand?
I understantd. You are right, Kemai do not need to know about all permissions/roles structures. In fact we only need permissions of the current logged user.
We already use the /api/users/me
endpoint. So maybe a persmissions array can be added in UserEntity:
UserEntity {
...
roles: [strings] // List of role names
permissions: [strings] // List of permission names
}
I cannot simply extend an endpoint with new arbitrary fields. The JSON structure is based on the internal entity structure.
This needs a new endpoint. Maybe a simple map with a list of base permissions:
A new endpoint like /api/permissions/me
?
Does this list of base permissions will be a selected subset of permissions available or guessed from actual permissions ?
Describe the problem
From kemai client, I would like to check if an user can create project/activity/... before sending the request
Describe the solution you'd like
As roles are already part of UserEntity, it may be usefull to get list of associated permissions of a given role
Describe alternatives you've considered
No response
Screenshots
No response