Skip to content

Commit 1cfb7cd

Browse files
mckaragozmckaragoz
authored
feat(authorization): add self-service permission inspection API (#114)
* feat(authorization): add self-service permission inspection API * Add Test and Docs * Docs Fix
1 parent ead92c3 commit 1cfb7cd

20 files changed

Lines changed: 960 additions & 96 deletions

File tree

‎apps/identity-lab/CodeBeam.UltimateAuth.IdentityLab/Components/Pages/Dashboard/MyAccessPage.razor‎

Lines changed: 94 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,7 @@
1818
<div>
1919
<span class="lab-access-eyebrow">PERSONAL AUTHORIZATION</span>
2020
<h1>My Access</h1>
21-
<p>
22-
Explore your roles, effective permissions,
23-
and how UltimateAuth evaluates access.
24-
</p>
21+
<p>Explore your assigned roles and permissions, then evaluate how UltimateAuth makes authorization decisions.</p>
2522
</div>
2623

2724
<MudChip T="string"
@@ -43,14 +40,15 @@
4340
<small>Roles assigned to your identity</small>
4441
</div>
4542

46-
@* <div class="lab-access-stat">
43+
<div class="lab-access-stat">
4744
<span class="lab-access-stat-icon">
4845
<MudIcon Icon="@Icons.Material.Filled.Key" />
4946
</span>
50-
<span>Effective Permissions</span>
51-
<strong>4</strong>
52-
<small>Illustrative permission set</small>
53-
</div> *@
47+
48+
<span>Assigned Permissions</span>
49+
<strong>@(_permissionsLoading ? "..." : _permissions.Count.ToString())</strong>
50+
<small>Permissions inherited from your roles</small>
51+
</div>
5452

5553
<div class="lab-access-stat">
5654
<span>Available Actions</span>
@@ -133,49 +131,71 @@
133131
</MudAlert>
134132
</section>
135133

136-
@* <section class="lab-access-card">
134+
<section class="lab-access-card">
137135
<div class="lab-access-card-heading">
138136
<div>
139-
<h2>Effective Permissions</h2>
140-
<p>Example permissions available to your identity.</p>
137+
<h2>Assigned Permissions</h2>
138+
<p>Permissions inherited from your assigned roles.</p>
141139
</div>
142-
<MudIcon Icon="@Icons.Material.Filled.Key"
143-
Color="Color.Primary" />
140+
141+
<MudIcon Icon="@Icons.Material.Filled.Key" Color="Color.Primary" />
144142
</div>
145143

146-
<div class="lab-permission-list">
147-
@foreach (var permission in _permissions)
148-
{
149-
<div class="lab-permission-item">
150-
<span class="lab-permission-icon">
151-
<MudIcon Icon="@Icons.Material.Filled.Check"
152-
Size="Size.Small" />
153-
</span>
144+
@if (_permissionsLoading)
145+
{
146+
<MudProgressLinear Indeterminate="true" Color="Color.Primary" Class="mb-4" />
147+
}
148+
else if (_permissionsError is not null)
149+
{
150+
<MudAlert Severity="Severity.Error">
151+
@_permissionsError
152+
</MudAlert>
153+
}
154+
else if (_permissions.Count == 0)
155+
{
156+
<div class="lab-result-empty">
157+
<span class="lab-result-empty-icon">
158+
<MudIcon Icon="@Icons.Material.Outlined.Lock" Size="Size.Large" />
159+
</span>
154160

155-
<div>
156-
<strong>@permission.Name</strong>
157-
<span>@permission.Description</span>
161+
<strong>No permissions assigned</strong>
162+
<p>Your assigned roles do not currently grant any permissions.</p>
163+
</div>
164+
}
165+
else
166+
{
167+
<div class="lab-permission-list">
168+
@foreach (var permission in _permissions)
169+
{
170+
<div class="lab-permission-item" @key="permission.Value">
171+
<span class="lab-permission-icon">
172+
<MudIcon Icon="@Icons.Material.Filled.VpnKey" Size="Size.Small" />
173+
</span>
174+
175+
<div>
176+
<strong>@permission.Value</strong>
177+
</div>
178+
179+
<MudChip T="string" Color="Color.Info" Variant="Variant.Outlined" Size="Size.Small">
180+
Assigned
181+
</MudChip>
158182
</div>
183+
}
184+
</div>
185+
}
159186

160-
<MudChip T="string"
161-
Color="Color.Success"
162-
Variant="Variant.Text"
163-
Size="Size.Small">
164-
Allowed
165-
</MudChip>
166-
</div>
167-
}
168-
</div>
169-
</section> *@
187+
<MudAlert Severity="Severity.Info" Variant="Variant.Text" Dense="true" Class="mt-4">
188+
Assigned permissions do not guarantee access.
189+
Policies and request context may still deny an operation.
190+
Use the Authorization Playground below to evaluate access.
191+
</MudAlert>
192+
</section>
170193
</div>
171194

172195
<div class="lab-access-section-heading">
173196
<span class="lab-access-eyebrow">INTERACTIVE AUTHORIZATION</span>
174197
<h2>Authorization Playground</h2>
175-
<p>
176-
Choose a resource and operation to explore
177-
how access decisions work.
178-
</p>
198+
<p>Choose a resource and operation to explore how access decisions work.</p>
179199
</div>
180200

181201
<div class="lab-playground-grid">
@@ -349,6 +369,10 @@
349369

350370
@code {
351371
private readonly List<UserRoleInfo> _roles = [];
372+
private readonly List<Permission> _permissions = [];
373+
374+
private bool _permissionsLoading;
375+
private string? _permissionsError;
352376

353377
private bool _loading;
354378
private string? _error;
@@ -368,7 +392,7 @@
368392

369393
protected override async Task OnInitializedAsync()
370394
{
371-
await LoadRolesAsync();
395+
await Task.WhenAll(LoadRolesAsync(), LoadPermissionsAsync());
372396
}
373397

374398
private async Task LoadRolesAsync()
@@ -406,6 +430,36 @@
406430
}
407431
}
408432

433+
private async Task LoadPermissionsAsync()
434+
{
435+
_permissionsLoading = true;
436+
_permissionsError = null;
437+
438+
try
439+
{
440+
var result = await UAuthClient.Authorization.GetMyPermissionsAsync();
441+
442+
if (!result.IsSuccess || result.Value is null)
443+
{
444+
_permissionsError =
445+
result.ErrorText ?? "Unable to load your permissions.";
446+
447+
return;
448+
}
449+
450+
_permissions.Clear();
451+
_permissions.AddRange(result.Value.Permissions);
452+
}
453+
catch (Exception)
454+
{
455+
_permissionsError = "Unable to load your permissions.";
456+
}
457+
finally
458+
{
459+
_permissionsLoading = false;
460+
}
461+
}
462+
409463
private async Task OnRolePageChangedAsync(int page)
410464
{
411465
_rolePage = page;

‎apps/identity-lab/CodeBeam.UltimateAuth.IdentityLab/Policy/SandboxUAuthAccessPolicy.cs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,8 @@ UAuthActions.Credentials.ListAdmin or
190190
UAuthActions.Sessions.GetChainSelf or
191191
UAuthActions.Sessions.GetChainAdmin or
192192
UAuthActions.Sessions.ListChainsSelf or
193-
UAuthActions.Sessions.ListChainsAdmin;
193+
UAuthActions.Sessions.ListChainsAdmin or
194+
UAuthActions.Authorization.Permissions.GetSelf;
194195

195196
private static bool IsAdminAction(string action)
196197
{

0 commit comments

Comments
 (0)