ezsystems/ezpublish-kernel — pull request #252 by andrerom (2013-03-05 13:58:28+00:00)
Title: Bundle permissions

Bug fix?	yes

New feature?	yes

BC breaks?	no

Deprecations?	yes

Tests pass?	yes

JIRA issue(s)	https://jira.ez.no/browse/EZP-20102

CLA	yes

Doc link	n/a

Aim: Update permission system in API to reflect new stack terminology, and missing conventions for how bundles and controllers can hint to eZ Publish they should be protected by eZ Publish.

This should be done without braking BC, which means:
- $module => $controller, but including bundle name, so eg. 'DemoBundle:Demo' , in case of policy with full bundle access: 'DemoBundle:*'
- $function => $action, example: "read", or in case of policies: "*" if access to all actions

TODO:
- [x] Rename module/function arguments and properties to controller/action
- [ ] Create a interface that Bundles can implement if they provide eZ Publish permissions, it should return list of controllers. If implemented but empty array, only "Bundle:*"/"*" or "*"/"*" permission is valid access.
- [ ] Create a interface that controllers can implement to provide list of actions and their limitations. If implemented but empty list of actions, then user must have access to all, as in "Bundle:Controller"/"*", "Bundle:*"/"*" or "*"/"*"
- [ ] Create a AliasPermission interface, so controllers can specify they use existing permissions, either other $controller, or legacy $module name for legacy permission re use, can internally be combined with controller interface above so a CoreBundle:ContentConrtollers can set alias as 'content', but at the same time provide the valid list of actions and limitations for API
- [ ] Create a compiler pass that generates API configuration based on info from bundles and Controllers, use that to validate addPolicy() & updatePolicy() as reported in EZP-20102
- [ ] Take advantage of this in Security Firewall if possible, but at least in base controller permission check.
- [ ] Document permission system for both api users and bundle creators