Editor grids permissions refactor, enhancements, and fixes

[smg6511]

Related PR

See also #15919. This is a re-packaging of that PR; this new PR seeks to cover all editor grids across the application and separates out some work (for a future PR) that had been begun around internationalizing core names and descriptions within some of the grids.

Related Issues

#14929, #16507

[opengeek]

@smg6511 Is this close to being ready?

[smg6511]

@opengeek Yes, very close - been hammering away at it. It should be ready for review by early next week.

[codecov]

Codecov Report

❌ Patch coverage is 12.85266% with 556 lines in your changes missing coverage. Please review.
✅ Project coverage is 21.49%. Comparing base (b1a02c3) to head (c7a0d69).
⚠️ Report is 50 commits behind head on 3.x.

Files with missing lines	Patch %	Lines
...tion/Processors/Security/Access/Policy/GetList.php	0.00%	33 Missing ⚠️
...Revolution/Processors/System/Dashboard/GetList.php	0.00%	28 Missing ⚠️
...ion/Processors/System/Dashboard/Widget/GetList.php	0.00%	27 Missing ⚠️
core/src/Revolution/Sources/modMediaSource.php	0.00%	27 Missing ⚠️
...ssors/Security/Access/UserGroup/Source/GetList.php	0.00%	25 Missing ⚠️
.../Processors/Workspace/PackageNamespace/GetList.php	0.00%	25 Missing ⚠️
...essors/Security/Access/Policy/Template/GetList.php	0.00%	24 Missing ⚠️
...volution/Processors/System/ContentType/GetList.php	0.00%	24 Missing ⚠️
...ors/Security/Access/UserGroup/Category/GetList.php	0.00%	23 Missing ⚠️
core/src/Revolution/Processors/Source/GetList.php	0.00%	23 Missing ⚠️
... and 27 more

Additional details and impacted files

@@             Coverage Diff              @@
##                3.x   #16653      +/-   ##
============================================
- Coverage     21.53%   21.49%   -0.04%     
- Complexity    10734    10775      +41     
============================================
  Files           565      566       +1     
  Lines         32540    32915     +375     
============================================
+ Hits           7007     7075      +68     
- Misses        25533    25840     +307     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[smg6511]

@opengeek @theboxer @Mark-H - Alright, I believe this is finally ready. Hope folks can carve out some time to go through it all ;-) !

[rthrash]

@smg6511 this is a big one—kudos on getting it to this stage! Since it's fresh on your mind and touches so many areas, it will take a while to fully review I suspect (was just discussing this with @jaygilmore and @opengeek).

Any suggestions or checklists of all the various nooks and crannies that should be tested to get this one merged?

[smg6511]

Any suggestions or checklists of all the various nooks and crannies that should be tested to get this one merged?

Ok, here's generally how I'd suggest going through this:

Initial Runthrough

I overhauled the base grids classes (in modx.grid.js) to remove duplication of existing methods that could be shared and provide access to the new methods introduced from a new central base class; the original Grid, LocalGrid, and JsonGrid extend from this new base. As such, every grid across the app should be interacted with to ensure all works as expected.

Grids with New "Creator" Column and Protected Records

These are the grids where MODX provides built-in records to start with and/or where an Extra installs a record (which usually should only be removed by un-installing the Extra [such as in Namespaces]):

• Namespaces
• Roles
• Contexts
• Media Sources
• Dashboards
• Content Types
• ACL Policies
• ACL Policy Templates

A few notable details:

• Although System Settings type grids would qualify for the same treatment as the above grids, implementation of it is really not feasible at this juncture due to the current data design. The identification of any given record's creator is largely derived or based on some hard-coded value (in the db or in php), as opposed to there being explicit flags in the db (columns where this type of info is persisted).
• For the most part, I've set most built-in items to be fully protected (i.e., in addition to being non-removable, certain fields are also set immutable [name and sometimes description, or in Content Types the mime type]). What will be carried through separately (in a follow-up PR) is to implement translation on these immutables fields.
• Following from the above point, matching field behavior has been implemented for a protected record's editing page (i.e., any field that was immutable on the grid is also immutable in the editing page [e.g., see Media Sources and Contexts]). Additionally, a new note is shown at the top of the panel alerting users re the item being protected and that some built-in fields may not be changed.

All Editor Grids

• Buttons and button menu items are either hidden or set to disabled when permissions for their action is not granted.
• Bulk Actions button menu items should, additionally, only be active when selections have been made (this is regardless of permissions on their respective actions).
• Some grids depend on the permissions of related objects when rendering certain items. A prime example is the Template Variables grid in a Template's editing panel: it renders a link on each TV name leading to that TV's editing page (but now, only if permission to edit & save TVs is granted). The various Access Permissions grids also cross link in this way. Pay attention to these direct-linked items as you review each area.
• Pencil icon should only show for editable fields (based on permissions)
• Gear menu should only show when there is at least one action on a row that the user has permission to take; otherwise it is hidden

General Strategy

As I was working through this PR, I kept one browser open with an Admin user with full permissions and another with an alternate user with permissions I'd vary to check my work. I basically systematically went through each nav menu item and completed updates to all relevant grids for one area at a time. I'd suggest the same for reviewing. Remember there are some grids that are a couple hops away, and can be easy to miss:

• TVs: There are multiple grids within this editing page to review (primarily the links to related objects [Contexts, Templates, User Groups] is what you'll want to pay attention to)
• Trash Manager
• User Group > Access Permissions (5 grids with various cross-linked objects)

[opengeek]

@smg6511 — I am trying to get a collaborative review session together for this PR so we can get it integrated sooner than later. If possible, could you resolve the current small conflict in modx.grid.js?

[smg6511]

@opengeek - I fixed the conflict but, dagonit, unintentionally ended up merging instead of force pushing because I was trying to fix a minor format error at the same time as resolving the conflict ... grrr. Hopefully this'll be ok.

[opengeek]

@opengeek - I fixed the conflict but, dagonit, unintentionally ended up merging not force pushing because I was trying to fix a minor format error at the same time as resolving the conflict ... grrr. Hopefully this'll be ok.

Unfortunately, that merge commit is problematic as it now shows completely unrelated changes in the diff.

[smg6511]

How to back out of that is the question then :-/ Maybe I can revert the merge?

[matdave]

Hey @smg6511,

I just noticed a new force push. Is this ready or are you still working on it? Do you have a rundown of things to test? It's 100 files, so I'm trying to figure out where to take the first bite.

[smg6511]

@matdave - Hi Mat - thanks for digging into this. To answer your questions:

• Re the force push, as this has been a long-running effort (which has been done for a while now), I've rebased every so often to ensure there are no conflicts. Short answer is, yes, it's ready ;-)
• See this comment earlier in the conversation thread here where I laid out a basic plan for how to review. Let me know if that's not sufficient. I also left my original draft of this PR open for reference; you might find my opening comments there useful as well.

[matdave]

So far it's looking good, I did notice one inconsistency while all of these are being adjusted. The button to create user groups is still present even if usergroup_new permissions aren't allowed.

[matdave]

BTW, I'm fine if you want to consider that out of scope since it's not a regression. Just now that everything else is working, I'm noticing the things that shouldn't be there.

[smg6511]

@matdave - Yeah, I didn't mess with that since it's tree-related and I was sticking specifically to the grids. There are some issues with the similarly-constructed Resource Groups trees and their toolbars/buttons I'd look to address separately.

[matdave]

Good work!

[smg6511]

@matdave - Thanks, man! Appreciate you taking the time to review. Cheers :-)