Refactor capabilities as they apply to dashboard sharing settings

[aaemnnosttv]

Feature Description

In #4481, capability checks were added to restrict which parts of the module sharing settings can be modified. This logic, while largely correct should be moved out of the module sharing settings class itself and live either in the controller or somewhere in between. Secondarily, the capability checks should be extended such that only users who can DELEGATE_MODULE_SHARING_MANAGEMENT can modify the management value for a module's sharing settings.

---

Do not alter or remove anything below. The following sections will be managed by moderators only.

Acceptance criteria

• No capability checks should be performed within the Module_Sharing_Settings class
  • These should instead happen within the REST endpoint handler for POST:sharing-settings as the only place where these are managed from Site Kit.
• The application of these capability checks should be done in a way that can be easily applied elsewhere without needing to duplicate/reimplement the logic
• Specifically the two capability checks should work as follows:
  • If the user does not have the ability to MANAGE_MODULE_SHARING_OPTIONS for a module, no change should be made to that module's sharedRoles value
  • If the user does not have the ability to DELEGATE_MODULE_SHARING_MANAGEMENT for a module, no change should be made to that module's management value

Implementation Brief

• Introduce a new Collection_Key_Cap_Filter utility class which is designed to filter a specific key of each item in a given collection based on a capability
  • The array key of each item in the array will be passed to the capability check as an argument for meta capability checks
• Apply the new key-cap filter to the incoming sharing settings in the POST:sharing-settings REST route definition before merging with the current sharing settings
  • One filter will be for the sharedRoles key, requiring the MANAGE_MODULE_SHARING_OPTIONS capability
  • One filter will be for the management key, requiring the DELEGATE_MODULE_SHARING_MANAGEMENT capability
  • Finally, merge the filtered result with the current sharing settings
• Update the implementation of Module_Sharing_Settings::merge to match Module_Settings::merge
• Finish and merge Move module sharing settings capability filtering to REST controller #5259

Test Coverage

• As a generic utility class, simple tests can be added for Collection_Key_Cap_Filter
• Current permission-related tests for Module_Sharing_Settings::merge should be moved to the REST_Dashboard_Sharing_ControllerTest, but only where current coverage is lacking

QA Brief

QA

• Create an admin user, say "admin1" and setup SiteKit but do not setup analytics. This makes "admin1" the owner of search-console.
• Create another admin user, say "admin2" and setup analytics making them the owner of analytics.
• Within the Dashboard Sharing UI, verify that both, "who can view" and "who can manage access" fields are editable by the owner of the module and setting changes take effect.
• Also verify that an admin can change the "who can view" field if the owner of that module has set the "who can manage access" setting to All Admins. Otherwise, no other admin should be able to change this setting.
• Finally, verify that only the owner of a module can change the "who can manage access" setting. No other user can change this setting.

• QA:Eng
  • Test the core/modules/data/sharing-settings with a API client or browser console with valid and invalid data and make sure AC is met.

Changelog entry

• Ensure only users with the DELEGATE_MODULE_SHARING_MANAGEMENT permission can modify the management value for a module's sharing settings.

[eugene-manuilov]

IB ✔️

[wpdarren]

QA Update: ✅

Verified:

• Within the Dashboard Sharing UI, both, "who can view" and "who can manage access" fields are editable by the owner of the module and setting changes take effect.
• An admin can change the "who can view" field if the owner of that module has set the "who can manage access" setting to All Admins. Otherwise, no other admin can change this setting.
• Only the owner of a module can change the "who can manage access" setting. No other user can change this setting.

Screenshots

Added QA:Eng due to the tests in QAB required.

[jimmymadon]

QA: Eng ✅

Tested with the QAB of #4481.

Verified failed requests when feature flag is off, for GET request and POST request without body params.

Verified successful adding and editing of settings along with changing owner of PSI when settings are changed with another admin.