Add User Allowed Pages Filtering - Draft Concept #1160
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Adds User Allowed Page filtering by utilizing user credentials provided by auth plugins. Allowed pages are retrieved from global.store[user].allowedpages.
cgjgh
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds User Allowed Page filtering by utilizing user credentials provided by auth plugins.
Description
This is more a proof of concept PR for user page filtering using auth plugins. With my tests this seems to have been quite robust, looking for additional feedback.
Still needs to be decided whether this functionality should be integrated into D2 directly, added as a plugin or as a 3rd party node.
Working Principle
D2 will function exactly as usual unless
global.store.enablePageFilterwith contextfileis set totrue.For now, UI for Admin Management of users, groups and pages is just a Node-RED flow using D2 widgets.
Users and groups are saved to Node-RED
filecontext storage so no database is needed. User allowed pages are then determined on a group basis and saved to and retrieved fromglobal.store[{user}].allowedPagesinmemory onlycontext.On
ui-baseemitConfig()all pages, groups and widgets are filtered based on the page they reside in or if they are UI scoped. Therefore, only the allowed pages, groups, and widgets are emitted in the config to the connected dashboards. This could also have added benefit of improved load speeds.Includes an optional zero-trust filtering approach where all users are denied access to all pages by default, or alternatively, enabling filtering for a specific user only if they have been added to user list (default?).
D2 pages are automatically populated as form options to
ui-formfor adding Groups in Admin Management UI, same with groups when adding UserUses
msg._client.user.emailas user ID, will need to arrive at some sort of standardization across auth plugins concerning thisAny users logged in using an auth provider will show up as detected user in UI, which you can then assign groups to.
Data Model
graph TD A[User] --> B[Group 1] A[User] --> C[Group 2] B[Group 1] --> D[Page 1] B[Group 1] --> E[Page 2] C[Group 2] --> F[Page 3] C[Group 2] --> G[Page 4] style A fill:#0000FF,stroke:#0000FF,color:#fff,rx:10,ry:10 style B fill:#008000,stroke:#008000,color:#fff,rx:10,ry:10 style C fill:#008000,stroke:#008000,color:#fff,rx:10,ry:10 style D fill:#800080,stroke:#800080,color:#fff,rx:10,ry:10 style E fill:#800080,stroke:#800080,color:#fff,rx:10,ry:10 style F fill:#800080,stroke:#800080,color:#fff,rx:10,ry:10 style G fill:#800080,stroke:#800080,color:#fff,rx:10,ry:10As can be seen above pages are assigned to groups and groups are then assigned to the user after which allowed pages are then determined.
Usage
Use this branch of D2: https://github.com/cgjgh/node-red-dashboard/tree/User-Page-Filtering
Attached below is a Node-RED flow with the necessary D2 UI for Admin Management of users, groups and pages.
Integrated into the PR is a test mode which you can toggle in UI and impersonate a specific user, therefore no auth plugins are required for testing.
New groups and users can be added with the included
ui-form.Table rows can be selected to load a form to edit user or group
Since D2
ui-tabledoes not yet support dynamic props, included in the flow below areinjectnodes with functions to generate JSON for each table with all columns for pages or groups predefined. This you can then copy from debug window and import and replace the existing tables in flow, or alternatively edit the table node.Example UI for Admin Management
Controls
onto deny access to all pages by default,offto enable filtering only for users existing in user list (prevents locking out users while in development)Tables
Example Flow
Related Issue(s)
Checklist
flowforge.yml?FlowFuse/helmto update ConfigMap TemplateFlowFuse/CloudProjectto update values for Staging/ProductionLabels
area:migrationlabel