chore: Move frontend authorization to permission based system (#9709)

We previously relied on user roles to determine whether to render specific routes in our frontend components. A permissions-based model is replacing this approach. Follow up: #9695 Co-authored-by: Pranav <pranavrajs@gmail.com>
2024-07-03 15:13:16 -07:00
parent 5520bf68f3
commit cc4851b19d
37 changed files with 582 additions and 229 deletions
--- a/app/javascript/dashboard/components/layout/Sidebar.vue
+++ b/app/javascript/dashboard/components/layout/Sidebar.vue
@@ -20,7 +20,7 @@
      :teams="teams"
      :custom-views="customViews"
      :menu-config="activeSecondaryMenu"
-      :current-role="currentRole"
+      :current-user="currentUser"
      :is-on-chatwoot-cloud="isOnChatwootCloud"
      @add-label="showAddLabelPopup"
      @toggle-accounts="toggleAccountModal"
@@ -37,7 +37,8 @@ import alertMixin from 'shared/mixins/alertMixin';
 import PrimarySidebar from './sidebarComponents/Primary.vue';
 import SecondarySidebar from './sidebarComponents/Secondary.vue';
 import keyboardEventListenerMixins from 'shared/mixins/keyboardEventListenerMixins';
-import router from '../../routes';
+import router, { routesWithPermissions } from '../../routes';
+import { hasPermissions } from '../../helper/permissionsHelper';

 export default {
  components: {
@@ -98,9 +99,13 @@ export default {
      return getSidebarItems(this.accountId);
    },
    primaryMenuItems() {
+      const userPermissions = this.currentUser.permissions;
      const menuItems = this.sideMenuConfig.primaryMenu;
      return menuItems.filter(menuItem => {
-        const isAvailableForTheUser = menuItem.roles.includes(this.currentRole);
+        const isAvailableForTheUser = hasPermissions(
+          routesWithPermissions[menuItem.toStateName],
+          userPermissions
+        );

        if (!isAvailableForTheUser) {
          return false;
--- a/app/javascript/dashboard/components/layout/config/sidebarItems/primaryMenu.js
+++ b/app/javascript/dashboard/components/layout/config/sidebarItems/primaryMenu.js
@@ -9,7 +9,6 @@ const primaryMenuItems = accountId => [
    featureFlag: FEATURE_FLAGS.INBOX_VIEW,
    toState: frontendURL(`accounts/${accountId}/inbox-view`),
    toStateName: 'inbox_view',
-    roles: ['administrator', 'agent'],
  },
  {
    icon: 'chat',
@@ -17,7 +16,6 @@ const primaryMenuItems = accountId => [
    label: 'CONVERSATIONS',
    toState: frontendURL(`accounts/${accountId}/dashboard`),
    toStateName: 'home',
-    roles: ['administrator', 'agent'],
  },
  {
    icon: 'book-contacts',
@@ -26,7 +24,6 @@ const primaryMenuItems = accountId => [
    featureFlag: FEATURE_FLAGS.CRM,
    toState: frontendURL(`accounts/${accountId}/contacts`),
    toStateName: 'contacts_dashboard',
-    roles: ['administrator', 'agent'],
  },
  {
    icon: 'arrow-trending-lines',
@@ -34,8 +31,7 @@ const primaryMenuItems = accountId => [
    label: 'REPORTS',
    featureFlag: FEATURE_FLAGS.REPORTS,
    toState: frontendURL(`accounts/${accountId}/reports`),
-    toStateName: 'settings_account_reports',
-    roles: ['administrator'],
+    toStateName: 'account_overview_reports',
  },
  {
    icon: 'megaphone',
@@ -44,7 +40,6 @@ const primaryMenuItems = accountId => [
    featureFlag: FEATURE_FLAGS.CAMPAIGNS,
    toState: frontendURL(`accounts/${accountId}/campaigns`),
    toStateName: 'ongoing_campaigns',
-    roles: ['administrator'],
  },
  {
    icon: 'library',
@@ -54,7 +49,6 @@ const primaryMenuItems = accountId => [
    alwaysVisibleOnChatwootInstances: true,
    toState: frontendURL(`accounts/${accountId}/portals`),
    toStateName: 'default_portal_articles',
-    roles: ['administrator'],
  },
  {
    icon: 'settings',
@@ -62,7 +56,6 @@ const primaryMenuItems = accountId => [
    label: 'SETTINGS',
    toState: frontendURL(`accounts/${accountId}/settings`),
    toStateName: 'settings_home',
-    roles: ['administrator', 'agent'],
  },
 ];

--- a/app/javascript/dashboard/components/layout/config/sidebarItems/settings.js
+++ b/app/javascript/dashboard/components/layout/config/sidebarItems/settings.js
@@ -24,7 +24,6 @@ const settings = accountId => ({
    'settings_inbox_list',
    'settings_inbox_new',
    'settings_inbox_show',
-    'settings_inbox',
    'settings_inboxes_add_agents',
    'settings_inboxes_page_channel',
    'settings_integrations_dashboard_apps',
@@ -46,6 +45,9 @@ const settings = accountId => ({
      icon: 'briefcase',
      label: 'ACCOUNT_SETTINGS',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator'],
+      },
      toState: frontendURL(`accounts/${accountId}/settings/general`),
      toStateName: 'general_settings_index',
    },
@@ -53,6 +55,9 @@ const settings = accountId => ({
      icon: 'people',
      label: 'AGENTS',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator'],
+      },
      toState: frontendURL(`accounts/${accountId}/settings/agents/list`),
      toStateName: 'agent_list',
      featureFlag: FEATURE_FLAGS.AGENT_MANAGEMENT,
@@ -61,6 +66,9 @@ const settings = accountId => ({
      icon: 'people-team',
      label: 'TEAMS',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator'],
+      },
      toState: frontendURL(`accounts/${accountId}/settings/teams/list`),
      toStateName: 'settings_teams_list',
      featureFlag: FEATURE_FLAGS.TEAM_MANAGEMENT,
@@ -69,6 +77,9 @@ const settings = accountId => ({
      icon: 'mail-inbox-all',
      label: 'INBOXES',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator'],
+      },
      toState: frontendURL(`accounts/${accountId}/settings/inboxes/list`),
      toStateName: 'settings_inbox_list',
      featureFlag: FEATURE_FLAGS.INBOX_MANAGEMENT,
@@ -77,6 +88,9 @@ const settings = accountId => ({
      icon: 'tag',
      label: 'LABELS',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator'],
+      },
      toState: frontendURL(`accounts/${accountId}/settings/labels/list`),
      toStateName: 'labels_list',
      featureFlag: FEATURE_FLAGS.LABELS,
@@ -85,6 +99,9 @@ const settings = accountId => ({
      icon: 'code',
      label: 'CUSTOM_ATTRIBUTES',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator'],
+      },
      toState: frontendURL(
        `accounts/${accountId}/settings/custom-attributes/list`
      ),
@@ -95,6 +112,9 @@ const settings = accountId => ({
      icon: 'automation',
      label: 'AUTOMATION',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator'],
+      },
      toState: frontendURL(`accounts/${accountId}/settings/automation/list`),
      toStateName: 'automation_list',
      featureFlag: FEATURE_FLAGS.AUTOMATIONS,
@@ -103,6 +123,9 @@ const settings = accountId => ({
      icon: 'bot',
      label: 'AGENT_BOTS',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator'],
+      },
      globalConfigFlag: 'csmlEditorHost',
      toState: frontendURL(`accounts/${accountId}/settings/agent-bots`),
      toStateName: 'agent_bots',
@@ -112,6 +135,9 @@ const settings = accountId => ({
      icon: 'flash-settings',
      label: 'MACROS',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator', 'agent'],
+      },
      toState: frontendURL(`accounts/${accountId}/settings/macros`),
      toStateName: 'macros_wrapper',
      featureFlag: FEATURE_FLAGS.MACROS,
@@ -120,6 +146,9 @@ const settings = accountId => ({
      icon: 'chat-multiple',
      label: 'CANNED_RESPONSES',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator', 'agent'],
+      },
      toState: frontendURL(
        `accounts/${accountId}/settings/canned-response/list`
      ),
@@ -130,6 +159,9 @@ const settings = accountId => ({
      icon: 'flash-on',
      label: 'INTEGRATIONS',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator'],
+      },
      toState: frontendURL(`accounts/${accountId}/settings/integrations`),
      toStateName: 'settings_integrations',
      featureFlag: FEATURE_FLAGS.INTEGRATIONS,
@@ -138,6 +170,9 @@ const settings = accountId => ({
      icon: 'star-emphasis',
      label: 'APPLICATIONS',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator'],
+      },
      toState: frontendURL(`accounts/${accountId}/settings/applications`),
      toStateName: 'settings_applications',
      featureFlag: FEATURE_FLAGS.INTEGRATIONS,
@@ -146,6 +181,9 @@ const settings = accountId => ({
      icon: 'key',
      label: 'AUDIT_LOGS',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator'],
+      },
      toState: frontendURL(`accounts/${accountId}/settings/audit-log/list`),
      toStateName: 'auditlogs_list',
      isEnterpriseOnly: true,
@@ -156,6 +194,9 @@ const settings = accountId => ({
      icon: 'document-list-clock',
      label: 'SLA',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator'],
+      },
      toState: frontendURL(`accounts/${accountId}/settings/sla/list`),
      toStateName: 'sla_list',
      isEnterpriseOnly: true,
@@ -166,6 +207,9 @@ const settings = accountId => ({
      icon: 'credit-card-person',
      label: 'BILLING',
      hasSubMenu: false,
+      meta: {
+        permissions: ['administrator'],
+      },
      toState: frontendURL(`accounts/${accountId}/settings/billing`),
      toStateName: 'billing_settings_index',
      showOnlyOnCloud: true,
--- a/app/javascript/dashboard/components/layout/sidebarComponents/Secondary.vue
+++ b/app/javascript/dashboard/components/layout/sidebarComponents/Secondary.vue
@@ -29,6 +29,8 @@ import SecondaryNavItem from './SecondaryNavItem.vue';
 import AccountContext from './AccountContext.vue';
 import { mapGetters } from 'vuex';
 import { FEATURE_FLAGS } from '../../../featureFlags';
+import { hasPermissions } from '../../../helper/permissionsHelper';
+import { routesWithPermissions } from '../../../routes';

 export default {
  components: {
@@ -60,9 +62,9 @@ export default {
      type: Object,
      default: () => {},
    },
-    currentRole: {
-      type: String,
-      default: '',
+    currentUser: {
+      type: Object,
+      default: () => {},
    },
    isOnChatwootCloud: {
      type: Boolean,
@@ -80,16 +82,16 @@ export default {
      return this.customViews.filter(view => view.filter_type === 'contact');
    },
    accessibleMenuItems() {
-      if (!this.currentRole) {
-        return [];
-      }
-      const menuItemsFilteredByRole = this.menuConfig.menuItems.filter(
-        menuItem =>
-          window.roleWiseRoutes[this.currentRole].indexOf(
-            menuItem.toStateName
-          ) > -1
+      const menuItemsFilteredByPermissions = this.menuConfig.menuItems.filter(
+        menuItem => {
+          const { permissions: userPermissions = [] } = this.currentUser;
+          return hasPermissions(
+            routesWithPermissions[menuItem.toStateName],
+            userPermissions
+          );
+        }
      );
-      return menuItemsFilteredByRole.filter(item => {
+      return menuItemsFilteredByPermissions.filter(item => {
        if (item.showOnlyOnCloud) {
          return this.isOnChatwootCloud;
        }
--- a/app/javascript/dashboard/components/layout/sidebarComponents/SecondaryNavItem.vue
+++ b/app/javascript/dashboard/components/layout/sidebarComponents/SecondaryNavItem.vue
@@ -65,27 +65,29 @@
        :show-child-count="showChildCount(child.count)"
        :child-item-count="child.count"
      />
-      <router-link
-        v-if="showItem(menuItem)"
-        v-slot="{ href, navigate }"
-        :to="menuItem.toState"
-        custom
-      >
-        <li class="pl-1">
-          <a :href="href">
-            <woot-button
-              size="tiny"
-              variant="clear"
-              color-scheme="secondary"
-              icon="add"
-              :data-testid="menuItem.dataTestid"
-              @click="e => newLinkClick(e, navigate)"
-            >
-              {{ $t(`SIDEBAR.${menuItem.newLinkTag}`) }}
-            </woot-button>
-          </a>
-        </li>
-      </router-link>
+      <Policy :permissions="['administrator']">
+        <router-link
+          v-if="menuItem.newLink"
+          v-slot="{ href, navigate }"
+          :to="menuItem.toState"
+          custom
+        >
+          <li class="pl-1">
+            <a :href="href">
+              <woot-button
+                size="tiny"
+                variant="clear"
+                color-scheme="secondary"
+                icon="add"
+                :data-testid="menuItem.dataTestid"
+                @click="e => newLinkClick(e, navigate)"
+              >
+                {{ $t(`SIDEBAR.${menuItem.newLinkTag}`) }}
+              </woot-button>
+            </a>
+          </li>
+        </router-link>
+      </Policy>
    </ul>
  </li>
 </template>
@@ -105,9 +107,10 @@ import {
  isOnMentionsView,
  isOnUnattendedView,
 } from '../../../store/modules/conversations/helpers/actionHelpers';
+import Policy from '../../policy.vue';

 export default {
-  components: { SecondaryChildNavItem },
+  components: { SecondaryChildNavItem, Policy },
  mixins: [adminMixin, configMixin],
  props: {
    menuItem: {
--- a/app/javascript/dashboard/components/policy.vue
+++ b/app/javascript/dashboard/components/policy.vue
@@ -0,0 +1,23 @@
+<script setup>
+import { useStoreGetters } from 'dashboard/composables/store';
+import { computed } from 'vue';
+import { hasPermissions } from '../helper/permissionsHelper';
+const props = defineProps({
+  permissions: {
+    type: Array,
+    required: true,
+  },
+});
+
+const getters = useStoreGetters();
+const user = getters.getCurrentUser.value;
+const hasPermission = computed(() =>
+  hasPermissions(props.permissions, user.permissions)
+);
+</script>
+
+<template>
+  <div v-if="hasPermission">
+    <slot />
+  </div>
+</template>