feature(Roles & Permissions): initial support

[webteckie]

Initial support for roles and permissions in keystone (a possible approach for solving #803). This PR mainly addresses defining a role and permissions model and based on this restricting Admin UI menus, list, and items per allow role/permissions. Please see gist at https://gist.github.com/webteckie/139c0303eaac1179290d for instructions on including support for roles and permissions in your application. This is definitely WIP and mainly putting out for review and comments and whether the approach makes sense. The main thing left to do is to add support for restricting server side list operations based on the configured user roles/permissions.

For reference, here are some screen shots of how this would look in the admin ui:

Roles screen:

Permissions Screen:

[adamscybot]

Super interested in this. Something I have needed also. Gonna give it a read over when I get a chance to see how it would fit with some use cases I've come across.

[ericelliott]

Permissions are definitely a necessary feature.

I'd like to hear what @JedWatson has to say about it, specifically, what are the key requirements, and does this proposal fill them?

Quick note on the failure, this is failing on Node 0.12.x, but works on 4.0. We're not testing 5.x, but probably should be.

[morenoh149]

some relevant reading I found useful http://dba.stackexchange.com/questions/1732/database-model-with-users-roles-and-rights
http://framework.zend.com/manual/1.12/en/zend.acl.html
https://www.owasp.org/index.php/Access_Control_Cheat_Sheet

https://github.com/seeden/rbac

[webteckie]

I don't plan to do anything else with this until @JedWatson gives a direction on it.

[mxstbr]

I think this is a must-have feature for a 1.0 release. I'm inclined to move this forward to be merged soon after we release 0.4 (so we don't delay that release even more), but if we can get this ready before 0.4 is finished even better. I'll poke Jed to share his thoughts on the direction of this asap!

[morenoh149]

I think @webteckie expressed interest in a solution leveraging https://github.com/seeden/mongoose-hrbac and https://github.com/seeden/rbac in the slack channel (as it would integrate pretty easily with mongoose). Either way roles and permissions are one of the most requested features.

[webteckie]

Initially I started trying to hook in https://github.com/seeden/rbac and quickly abandoned the idea since I think it may prove easier to slowly develop keystone's own rbac API around its list modeling. Instead of focusing in the API, I decided to focus on the Admin UI side of things disabling access to admin parts and entities based on some rbac view model as well as the based on the currently signed in user. I also would like the feasibility of being able to do all rbac config via the admin UI and I was able to prove with the approach I took that that is easily doable. Hopefully we can get some consensus on this and move forward with an approach that handles most user needs :-)

[astr0sl0th]

If I pull from the main repo will this be available?

[wmertens]

This is nice, but I'm afraid it won't be specific enough. Imagine for example a list of blog posts, where only the original author can edit the post, or maybe documents where you get access to more fields depending on your user level.

I think this means that there should be a callback system where you can override the results of the default ACL.

Also, perhaps it would be good to make a list method .findFor() which expects a Viewer (User) object as the first argument, with zero permissions assumed by default.

[VinayaSathyanarayana]

Any Updates on whether this is being taken up?

[JedWatson]

@VinayaSathyanarayana see keystonejs/keystone-test-project#21 for discussion on some underlying features I'm proposing

[arturkasperek]

@webteckie It would be super if you resolve conflicts

[webteckie]

@arturkasperek please see keystonejs/keystone-test-project#21

I believe that's what the initial support will be.

[VinayaSathyanarayana]

Any update on this?

[Tushar-Gupta]

Any update on this? Really need this feature for my project.

[vamshi9]

Is it working? Can I give a try on this? Or should I go with creating other user model and create separate admin panel for users

[vinicius-ronconi]

Any update here?

[luismsaraiva]

Can you update this to the latest version of KeystoneJS? Cheers

[nvs2394]

@here Any update here ?

[GreenMonkeySaveEarth]

Any update on this? Need this badly.

[JedWatson]

This isn't going to land in v4, but is implemented in v5