Backend + Frontend: Roles and access levels - Githubissues

serum-390 / soen390-team16-godzilla

Codename GODZILLA: project for course SOEN-390

GNU General Public License v3.0

4 stars 0 forks source link

Backend + Frontend: Roles and access levels #177

Open Ysabz opened 3 years ago

Ysabz commented 3 years ago

Add roles, access levels, etc. - authorization features

obonobo commented 3 years ago

TODO

Frontend

[x] Pop up card with edit user controls
[x] Discord-style "friends-list" list of all system users on the right side of the view

Backend

APIs for managing roles and access levels of different users
- [ ] Add is_admin column to erp_user table
- [ ] CRUD API for is_admin and authorities fields, can reuse the GodzillaUserRepository as a database repository.
  - [ ] GET /api/user/permissions/?id=123&name=MyName => returns JSON with isAdmin: true | false field and roles: [seller, buyer, manager] field.
  - [ ] PATCH /api/user/permissions/?id=123&name=MyName, request contains json that specifies what permissions fields to update, looks like:
```
{
    "isAdmin": true,
    "roles": [
        "SELLER", 
        "BUYER"
    ]
}
```
[ ] Come up with an access management system: role-based vs privilege levels
[ ] Lock down all APIs behind various levels of access