Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use recommended policy-based authorization for Org Admin and Server Admin pages. #662

Merged
merged 3 commits into from
Jun 15, 2023

Conversation

bitbound
Copy link
Contributor

This started as fixing the Server Logs page. The loading screen wasn't showing initially, because the LoaderHarness needed to register for events earlier in the component lifecycle.

Then wanted to fix one of the many tech debt items that have been bothering me for a while. The pages requiring Org Admin and Server Admin rights (derived from AuthComponentBase) were conditionally including/excluding content directly in the page based on the current user.

I changed these pages to use the recommended policy-based authorization approach, and added them to the pages Authorize tag. This lets the AuthorizeView in the app's router handle authorization for all the pages and displays the same template when not authorized.

Also fixed a bug causing the device to not update on heartbeat.


Please read the following. Do not delete below this line.

Thank you for your contribution to the Remotely project. It is required that contributors assign copyright to Immense Networks so we retain full ownership of the project.

This makes it easier for other entities to use the software because they only have to deal with one copyright holder. It also gives me assurance that we'll be able to make decisions in the future without gathering and consulting all contributors.

While this may seem odd, many open source maintainers practice this. Here are a couple well-known examples:

A nice article on the topic can be found here: https://haacked.com/archive/2006/01/26/WhoOwnstheCopyrightforAnOpenSourceProject.aspx/

By submitting this PR, you agree to the following:

You hereby assign copyright in this PR's code to the Remotely project and its copyright holder, Immense Networks, to be licensed under the same terms as the rest of the code. You agree to relinquish any and all copyright interest in the software, to the detriment of your heirs and successors.

@@ -1,4 +1,5 @@
@page "/scripts/{activeTab?}"
@attribute [Authorize]

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is is correct to not specify a policy here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah. The default policy for the Authorize attribute is "IsAuthenticated". So you can add just the attribute like this to anything that requires the user to be logged in, but nothing else.

@bitbound bitbound merged commit 4160d44 into master Jun 15, 2023
@bitbound bitbound deleted the tech/admin-auth-policies branch June 15, 2023 13:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants