Skip to content

Commit 956da2a

Browse files
amirch1amirch1
authored
fix: prevent KMC access when the user has no KMC permissions SUP-37570 (#1048)
1 parent d423f1a commit 956da2a

File tree

4 files changed

+69
-43
lines changed

4 files changed

+69
-43
lines changed

‎src/applications/administration-roles-app/roles-store/permission-tree-nodes.ts

+5
Original file line numberDiff line numberDiff line change
@@ -419,5 +419,10 @@ export const PermissionTreeNodes: PermissionTreeNode[] = [
419419
label: 'End-User Bulk Upload'
420420
}
421421
]
422+
},
423+
{
424+
value: KMCPermissions.KMC_ACCESS,
425+
label: 'KMC Access',
426+
noChildren: true
422427
}
423428
];

‎src/i18n/en.json

+1
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,7 @@
136136
"error": "Error",
137137
"connectionError": "Error connecting to server",
138138
"invalidKs": "User session has expired. Please re-login.",
139+
"noAccess": "You don't have permission to access Kaltura Management Console. Please contact your admin to get access.",
139140
"export": "We are preparing your report. We will send it to your email address shortly."
140141
},
141142
"redirect":{

‎src/shared/kmc-shared/kmc-permissions/kmc-permissions.ts

+3-1
Original file line numberDiff line numberDiff line change
@@ -146,5 +146,7 @@ export enum KMCPermissions {
146146
'APP_TOKEN_UPDATE' = 1136,
147147
'APP_TOKEN_DELETE' = 1137,
148148
'FEATURE_V7_STUDIO_PERMISSION' = 1138,
149-
'FEATURE_RECYCLE_BIN' = 1139
149+
'FEATURE_RECYCLE_BIN' = 1139,
150+
'KMC_ACCESS' = 1140,
151+
'KMC_READ_ONLY' = 1141
150152
}

‎src/shared/kmc-shell/auth/app-authentication.service.ts

+60-42
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,50 @@
1-
import { Injectable } from '@angular/core';
2-
import { Location } from '@angular/common';
3-
import { Observable } from 'rxjs';
4-
import { KalturaAuthentication, KalturaClient, KalturaMultiRequest, KalturaRequestOptions, SessionEndAction, SsoLoginAction, AdminUserSetInitialPasswordAction } from 'kaltura-ngx-client';
5-
import { UserLoginByLoginIdAction } from 'kaltura-ngx-client';
6-
import { UserGetByLoginIdAction } from 'kaltura-ngx-client';
7-
import { UserGetAction } from 'kaltura-ngx-client';
8-
import { PartnerGetInfoAction } from 'kaltura-ngx-client';
9-
import { PermissionListAction } from 'kaltura-ngx-client';
10-
import { KalturaResponseProfileType } from 'kaltura-ngx-client';
11-
import { KalturaDetachedResponseProfile } from 'kaltura-ngx-client';
12-
import { KalturaPermissionFilter } from 'kaltura-ngx-client';
13-
import { KalturaPermissionListResponse } from 'kaltura-ngx-client';
14-
import { KalturaUserRole } from 'kaltura-ngx-client';
15-
import { KalturaFilterPager } from 'kaltura-ngx-client';
16-
import { KalturaPermissionStatus } from 'kaltura-ngx-client';
17-
import { UserRoleGetAction } from 'kaltura-ngx-client';
1+
import {Injectable} from '@angular/core';
2+
import {Location} from '@angular/common';
3+
import {Observable, of as ObservableOf, throwError} from 'rxjs';
4+
import {
5+
AdminUserSetInitialPasswordAction,
6+
AdminUserUpdatePasswordAction,
7+
KalturaAuthentication,
8+
KalturaClient,
9+
KalturaDetachedResponseProfile,
10+
KalturaFilterPager,
11+
KalturaMultiRequest,
12+
KalturaPartner,
13+
KalturaPermissionFilter,
14+
KalturaPermissionListResponse,
15+
KalturaPermissionStatus,
16+
KalturaRequestOptions,
17+
KalturaResponseProfileType,
18+
KalturaUser,
19+
KalturaUserRole,
20+
PartnerGetInfoAction,
21+
PermissionListAction,
22+
SessionEndAction,
23+
SsoLoginAction,
24+
UserGetAction,
25+
UserGetByLoginIdAction,
26+
UserLoginByKsAction,
27+
UserLoginByLoginIdAction,
28+
UserResetPasswordAction,
29+
UserRoleGetAction
30+
} from 'kaltura-ngx-client';
1831
import * as Immutable from 'seamless-immutable';
19-
import { AppUser } from './app-user';
20-
import { UserResetPasswordAction } from 'kaltura-ngx-client';
21-
import { AdminUserUpdatePasswordAction } from 'kaltura-ngx-client';
22-
import { PageExitVerificationService } from 'app-shared/kmc-shell/page-exit-verification/page-exit-verification.service';
23-
import { UserLoginStatusEvent } from 'app-shared/kmc-shared/events';
24-
import { KalturaPartner } from 'kaltura-ngx-client';
25-
import { KalturaUser } from 'kaltura-ngx-client';
26-
import { AppEventsService } from 'app-shared/kmc-shared/app-events';
27-
import { KalturaLogger } from '@kaltura-ng/kaltura-logger';
28-
import { KMCPermissions, KMCPermissionsService } from 'app-shared/kmc-shared/kmc-permissions';
29-
import { serverConfig } from 'config/server';
30-
import { BrowserService } from 'app-shared/kmc-shell/providers/browser.service';
31-
import { UserLoginByKsAction } from 'kaltura-ngx-client';
32-
import { KmcServerPolls } from 'app-shared/kmc-shared/server-polls';
33-
import { HttpClient } from '@angular/common/http';
34-
import { buildBaseUri } from 'config/server';
35-
import { KmcMainViewsService } from 'app-shared/kmc-shared/kmc-views/kmc-main-views.service';
36-
import { kmcAppConfig } from '../../../kmc-app/kmc-app-config';
37-
import { RestorePasswordViewService } from 'app-shared/kmc-shared/kmc-views/details-views/restore-password-view.service';
38-
import {switchMap, map, catchError} from 'rxjs/operators';
39-
import { of as ObservableOf } from 'rxjs';
40-
import { AuthenticatorViewService } from "app-shared/kmc-shared/kmc-views/details-views";
41-
import { throwError } from 'rxjs';
32+
import {AppUser} from './app-user';
33+
import {PageExitVerificationService} from 'app-shared/kmc-shell/page-exit-verification/page-exit-verification.service';
34+
import {UserLoginStatusEvent} from 'app-shared/kmc-shared/events';
35+
import {AppEventsService} from 'app-shared/kmc-shared/app-events';
36+
import {KalturaLogger} from '@kaltura-ng/kaltura-logger';
37+
import {KMCPermissions, KMCPermissionsService} from 'app-shared/kmc-shared/kmc-permissions';
38+
import {buildBaseUri, serverConfig} from 'config/server';
39+
import {BrowserService} from 'app-shared/kmc-shell/providers/browser.service';
40+
import {KmcServerPolls} from 'app-shared/kmc-shared/server-polls';
41+
import {HttpClient} from '@angular/common/http';
42+
import {KmcMainViewsService} from 'app-shared/kmc-shared/kmc-views/kmc-main-views.service';
43+
import {kmcAppConfig} from '../../../kmc-app/kmc-app-config';
44+
import {RestorePasswordViewService} from 'app-shared/kmc-shared/kmc-views/details-views/restore-password-view.service';
45+
import {catchError, map, switchMap} from 'rxjs/operators';
46+
import {AuthenticatorViewService} from "app-shared/kmc-shared/kmc-views/details-views";
47+
import {AppLocalization} from "@kaltura-ng/mc-shared";
4248

4349
const ksSessionStorageKey = 'auth.login.ks';
4450

@@ -97,6 +103,7 @@ export class AppAuthentication {
97103
private _permissionsService: KMCPermissionsService,
98104
private _http: HttpClient,
99105
private _appEvents: AppEventsService,
106+
private _appLocalization: AppLocalization,
100107
private _location: Location,
101108
private _kmcViewsManager: KmcMainViewsService,
102109
private _restorePasswordView: RestorePasswordViewService,
@@ -318,6 +325,17 @@ export class AppAuthentication {
318325
const partnerPermissionList = permissionList.objects.map(item => item.name);
319326
const userRolePermissionList = userRole.permissionNames.split(',');
320327
this._permissionsService.load(userRolePermissionList, partnerPermissionList);
328+
// check if the user has KMC access permission and block KMC loading if not
329+
if (!this._permissionsService.hasPermission(KMCPermissions.KMC_ACCESS)) {
330+
this._browserService.alert({
331+
header: this._appLocalization.get('app.common.attention'),
332+
message: this._appLocalization.get('app.common.noAccess'),
333+
accept: () => {
334+
this.logout(false);
335+
}
336+
});
337+
return;
338+
}
321339

322340
const appUser: Immutable.ImmutableObject<AppUser> = Immutable({
323341
ks,
@@ -369,10 +387,10 @@ export class AppAuthentication {
369387
this._browserService.removeFromSessionStorage(ksSessionStorageKey);
370388
}
371389

372-
logout() {
390+
logout(reloadPage = true) {
373391
this._logger.info('handle logout request by the user');
374392
this._clearSessionCredentials();
375-
this._logout();
393+
this._logout(reloadPage);
376394
}
377395

378396
private _loginByKS(loginToken: string, storeCredentialsInSessionStorage): Observable<boolean> {

0 commit comments

Comments
 (0)