Add users with roles and finish role-based page authorization #3002

apedroferreira · 2023-12-15T19:10:23Z

Still under a feature flag, as runtime RPC protection is needed next and can be done in a separate PR.

List of features:

Assign roles to users individually by email (I considered several options and this seemed like the best one, eventually we could allow for importing CSVs and such. It does not seem possible in @auth/core to map roles from a service and I'm not sure if that would even be desirable or straightforward for users).
Disable users from accessing pages if they don't have the correct roles (client-side only, as our routing for these pages is client-side? Should we also try to block by HTTP somehow or it's not worth it?).
Hide inaccessible pages in sidebar + show message that page is inaccessible if user somehow navigates to them.

…nding

…bute

…h https domain

… Github

Janpot · 2024-01-02T09:54:08Z

docs/schemas/v1/definitions.json

@@ -47,6 +75,31 @@
                    ]
                  },
                  "description": "Available roles for this application. These can be assigned to users."
+                },
+                "users": {


I think we can start with authentication only for this PR.

I don't think it makes sense at the moment for the toolpad configuration to act as a user pool. This would require developers to have to hardcode each user in the configuration. And likely be a privacy problem for public repos.

We will create a role mapping once we have an authentication provider that supports passing roles. So not for GitHub/Google. We don't support RBAC for our free version anyway.

edit: just realized that the authentication part of this PR is stacked from another PR. The comment still stands though. We won't support rbac for the free version. We should probably add azure AD provider first before creating a role mapping.

Ok, I can keep most of this PR on hold if that's the best course and see what can be merged for now.
We can also have a more in-depth discussion about this and see if there's any more solutions we can agree on.

apedroferreira · 2024-01-03T16:09:53Z

packages/toolpad-app/src/server/auth.ts

+                id: profile.email ?? String(profile.id),
+                name: profile.name,
+                email: profile.email,
+                image: profile.avatar_url,


id: profile.id.toString(),
name: profile.name ?? profile.login,
email: profile.email,
image: profile.avatar_url,

apedroferreira · 2024-01-03T16:24:39Z

packages/toolpad-app/src/server/auth.ts

+              const roles = await getProfileRoles(profile.email, project);
+
+              return {
+                id: profile.email,


Suggested change

id: profile.email,

id: profile.sub,

?

apedroferreira · 2024-01-16T16:27:09Z

Replaced by #3077, can revisit later if we decide to add our own role assignments.

apedroferreira added 30 commits November 21, 2023 20:17

Set routes for auth, try Google provider

9bd84ab

Add Github login

89247f7

Add header bar, logout functionality, user session provider

a9a1df4

Sign in directly from header bar

5c63e8e

Make header bar fixed, make Github and Google login buttons match bra…

cb46225

…nding

Better error ahandling UX, show only the relevant auth providers

b5ee279

Only show login/logout for protected pages + add protected page attri…

465d8cb

…bute

Refactor for application.yml as source of provider

cfb5a09

Merge remote-tracking branch 'upstream/master' into authentication

811f156

UI fixes, more setup for auth provider setting

5f18dc8

Check email domain for all auth providers

5d6a4ca

Improve auth error handling

a960f38

Temporarily disable some auth options to test in live application wit…

f3236e6

…h https domain

Fix auth redirect path and header spacing, enable trusted host option

cdaf5d2

Forgot this

eb3469a

Skip CSRF check

12b1e89

Add proper CSRF protection

45c9662

Try not having explicit redirect to see if https:// callbacks work in…

4dcfbbd

… Github

Try sending callback url in client

884b199

try setting redirect again in server

18b78a4

Try using url in redirect

8b08e93

Pass values from client again

e20122a

Manually form redirect URL

0a2fabc

Refactor

15feb91

Merge remote-tracking branch 'upstream/master' into authentication

89dc111

Add authentication configuration controls

9e1a588

Add future link to docs/guides

b4291e9

Update values in app.yaml file

39fe44e

Add secret configuration, finish making values sync with app.yaml

4ca271d

Simplify a lot - previous approach was not looking good

e6c1ebd

apedroferreira added 6 commits December 26, 2023 19:53

More improvements

9bbfeec

Disable feature flag

8cdd171

Add space

2bea45c

Update JSON schemas

1e2fc0c

Merge remote-tracking branch 'origin/authentication' into auth-roles

27b772a

Hide pages in sidebar if user does not have the necessary roles

83874f8

github-actions bot removed the PR: out-of-date The pull request has merge conflicts and can't be merged label Dec 27, 2023

apedroferreira added 4 commits December 27, 2023 17:24

Fix page crash when there are no pages

e56e002

Generate JSON schemas

ff39633

Merge remote-tracking branch 'upstream/master' into auth-roles

84961dd

Disable feature flag

0565d71

apedroferreira changed the title ~~[WIP] Assign roles to users for authorization~~ Assign roles to users for authorization Dec 27, 2023

apedroferreira marked this pull request as ready for review December 27, 2023 17:42

apedroferreira changed the title ~~Assign roles to users for authorization~~ Add users with roles and finish page-level role-based authorization Dec 27, 2023

apedroferreira changed the title ~~Add users with roles and finish page-level role-based authorization~~ Add users with roles and finish pages role-based authorization Dec 27, 2023

apedroferreira changed the title ~~Add users with roles and finish pages role-based authorization~~ Add users with roles and finish role-based page authorization Dec 27, 2023

apedroferreira mentioned this pull request Dec 27, 2023

Protect runtime RPC with authorization #3034

Closed

Janpot reviewed Jan 2, 2024

View reviewed changes

github-actions bot added the PR: out-of-date The pull request has merge conflicts and can't be merged label Jan 2, 2024

Merge remote-tracking branch 'upstream/master' into auth-roles

9acb08a

github-actions bot removed the PR: out-of-date The pull request has merge conflicts and can't be merged label Jan 2, 2024

apedroferreira commented Jan 3, 2024

View reviewed changes

apedroferreira mentioned this pull request Jan 3, 2024

Add universal required email configuration for authentication #3047

Merged

github-actions bot added PR: out-of-date The pull request has merge conflicts and can't be merged and removed PR: out-of-date The pull request has merge conflicts and can't be merged labels Jan 7, 2024

apedroferreira closed this Jan 16, 2024

apedroferreira deleted the auth-roles branch January 16, 2024 16:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add users with roles and finish role-based page authorization #3002

Add users with roles and finish role-based page authorization #3002

apedroferreira commented Dec 15, 2023 •

edited

Loading

Janpot Jan 2, 2024 •

edited

Loading

apedroferreira Jan 2, 2024

apedroferreira Jan 3, 2024

apedroferreira Jan 3, 2024 •

edited

Loading

apedroferreira commented Jan 16, 2024

Add users with roles and finish role-based page authorization #3002

Add users with roles and finish role-based page authorization #3002

Conversation

apedroferreira commented Dec 15, 2023 • edited Loading

Janpot Jan 2, 2024 • edited Loading

Choose a reason for hiding this comment

apedroferreira Jan 2, 2024

Choose a reason for hiding this comment

apedroferreira Jan 3, 2024

Choose a reason for hiding this comment

apedroferreira Jan 3, 2024 • edited Loading

Choose a reason for hiding this comment

apedroferreira commented Jan 16, 2024

apedroferreira commented Dec 15, 2023 •

edited

Loading

Janpot Jan 2, 2024 •

edited

Loading

apedroferreira Jan 3, 2024 •

edited

Loading