How to implement client application‘s permissions

[hyzx86]

I built a single page application using react + orchard core

I am designing its permission module:

1. Implement a sub permission function on the orchard core, and transform the current permission system of the orchard core so that it can be displayed as a tree structure
2. Implement an API on the OC, which can manage different application permissions

[MikeAlhayek]

No sure what the question is. But if you want to implement tree structure, you could create a new class CustomPermission that would inherit from Permission and add a new property call Parent something like this

public class CustomPermission : Permission
{
    public CustomPermission? Parent { get; set; }
}

Then you would also add Parent to the ImpliedBy collection. Then you would change the Role Edit/Create page to display the permission by grouping by parent recursively to show the permissions in a tree structure.

[hyzx86]

Thank you for your reply,

I looked at the list of data permissions. There are multiple ImpliedBy under one permission
Therefore, it is not realistic to use this structure to build a tree
I'd better keep the status quo and build limited permissions on the client page
After all, the permission management function is only used by developers more often

[hyzx86]

My idea is to develop a SaaS service with low code using OC
I sorted out my needs, which is about this.

The permissions on the left are managed by the site administrator. We call them site permissions
The right permission is managed by the OC Admin Dasboard. We call it the background permission

Site permissions include some static permissions, that is, permission definitions that cannot be deleted
Some permission definitions that already exist in the OC will be reused here

In addition, it also includes some user-defined permissions, which can be defined and authorized in the running state of the program
Then you can modify the relevant query statements and apply them to specific function pages

[hyzx86]

Now think about it, the presentation of the permission management interface is not the focus

Mainly, I want to separate multiple sets of permission management
MVC on the server side （OC Dashboard）
Have the highest permissions, and the configurable permissions are all
The permissions configured on the client side are only limited to the permissions of the client application

[hyzx86]

Yes, I know, but my client application also needs some permission control，these will be controlled by the users of the client application. They cannot log in to the OC Admin Dashboard.

For example, a user creates a page that contains some additional permissions
However, these permissions may coincide with some content types on the OC
For example, customer information management module
In OC, it includes:
Create customer, delete customer and modify customer
In my app:
View my customers, view my subordinate customers, export customer data, import customers, and then the built-in permissions in OC: create customers, delete customers, and modify customers

In addition, it also includes the access rights of some URL addresses (SPA routing path)

If I directly query all installed permissions from OC
Then the user will be able to set all permissions for himself
My current idea is to develop a filtered permission list for client applications,
In addition, some additional permissions specific to this application are included
Special permissions can be distinguished by different "claimtypes" or saved to other locations. OC is only used to store them.

[hyzx86]

My initial idea was to rewrite the openid module and add a list of properties hidden from the client in the application management function
Later, I thought it might be more appropriate for me to write them directly in the web API for querying permission lists. After all, most sensitive permissions are static

[MikeAlhayek]

Not sure. But it sounds like you want to change how permissions are handled by using permission + user type combo. Look at how OC use permission handlers. You may need to add custom permission handlers to implement your validation

[Skrypt]

Roles are there for "User Type" but if you need to group your users you will need a custom permission handler.

[hyzx86]

Yes indeed, All that's left is a functional design problem, not an OC problem