… (#120) * docs(role-based-content): import spec from openspec change Brings the role-feature-permissions spec into the build branch so the implementation can land alongside the spec it fulfils. Sourced from the spec/role-based-content branch authored by /opsx-ff for issue #91. Refs #91 * feat(role-based-content): Stage 1 — data layer Native mydash persistence (custom DB tables + Mappers + Service + Controller). The /opsx-ff-generated spec assumed OpenRegister; this translates the same conceptual design to mydash's actual stack. New tables: - mydash_role_feature_perms (REQ-RFP-001..010): name, description, group_id, allowed_widgets (json), denied_widgets (json), priority_weights (json), created_at, updated_at. Unique on group_id. - mydash_role_layout_defaults (REQ-RFP-002): name, description, group_id, widget_id, grid_x/y/width/height, sort_order, is_compulsory. Unique on (group_id, widget_id). New code: - lib/Db/RoleFeaturePermission.php + RoleFeaturePermissionMapper.php - lib/Db/RoleLayoutDefault.php + RoleLayoutDefaultMapper.php - lib/Migration/RoleFeaturePermissionTableBuilder.php - lib/Migration/RoleLayoutDefaultTableBuilder.php - lib/Migration/Version001007Date20260501120000.php - lib/Service/RoleFeaturePermissionService.php — implements: listPermissions / savePermission / deletePermission listLayoutDefaults / saveLayoutDefault / deleteLayoutDefault getAllowedWidgetIds — multi-group resolution per design.md §"Multi-group Resolution Algorithm" (group_order priority, first-match base, additional groups widen, deny-wins, default fallback) isWidgetAllowed — convenience wrapper seedLayoutFromRoleDefaults — guarded by zero-existing-placements invariant (REQ-RFP-002 scenario 3) - lib/Controller/RoleFeaturePermissionApiController.php — admin-only, same requireAdmin() pattern as AdminController - appinfo/routes.php: 6 new admin routes (list/save/delete × permissions + layout-defaults), inserted after the existing admin section Persistence approach diverges from spec: - No OpenRegister ObjectService / ConfigurationService / @self envelopes (mydash doesn't use OpenRegister) - No mydash_register.json - Seed data deferred to Stage 4 (will use a one-time PHP repair step matching mydash's conventions, not JSON import) Refs #91 * feat(role-based-content): Stage 2 — integration Wires RoleFeaturePermissionService into the existing widget + dashboard flows so the role permission set is enforced at runtime. Changes: - DashboardService::tryCreateFromTemplate(): now calls RoleFeaturePermissionService::seedLayoutFromRoleDefaults BEFORE the hardcoded 'recommendations + activity' default. New users in a group with RoleLayoutDefault rows get a role-seeded layout (REQ-RFP-002). Falls back to the legacy hardcoded defaults only when no role-default rows match. Constructor extended with the new service dependency. - WidgetApiController::listAvailable(): filters the widget catalogue by the caller's allowed-widget set. Returns the full catalogue when no RoleFeaturePermission is configured for any of the user's groups (or the user is unauthenticated). REQ-RFP-001 / REQ-RFP-003. - InitialStateBuilder: new `allowedWidgets` workspace key + setter. Required key on the workspace page so the JS reader sees it on every payload (null = no restriction; array = filtered list). REQ-RFP-010. - PageController::index(): calls the new InitialStateBuilder::setAllowedWidgets() with the result from RoleFeaturePermissionService::getAllowedWidgetIds(). Note on the per-feature 403 + audit trail required by REQ-RFP-006: mydash currently has no per-widget URL endpoint guarded by user-level auth (the listAvailable filter is the entire user surface), and no AuditTrailService analogue. Deferred to a follow-up once the widget proxy endpoints land — the listAvailable filter is sufficient for the card library and dashboard rendering scenarios in REQ-RFP-001 / 003. Refs #91 * feat(role-based-content): Stage 3 — frontend (admin UI + i18n) New: - src/stores/roleFeaturePermissions.js — Pinia store wrapping the four CRUD endpoints from Stage 1's RoleFeaturePermissionApiController. - src/components/admin/RolePermissionsSection.vue — admin UI section listing existing role-feature-permission rows with chips for allowed and (red-tinted) denied widgets. Add/edit modal accepts comma- separated allow/deny lists; delete confirms with window.confirm(). Wired into AdminSettings.vue under existing template-management section. Initial-state contract: - src/utils/loadInitialState.js — adds `allowedWidgets: null` to the workspace defaults (REQ-RFP-010). Backend already pushes the value via InitialStateBuilder::setAllowedWidgets() in Stage 2. i18n: - 12 new keys added to l10n/en.json + en.js + nl.json + nl.js (Dutch translations supplied; en/nl key-set parity preserved at 210). Out of scope for this stage (scheduled for Stage 4): - RoleLayoutDefault admin UI (the API exists, no UI yet) - WidgetPicker filtering by allowedWidgets on the workspace page (currently relies on server-side filtering in WidgetApiController::listAvailable()) Refs #91 * feat(role-based-content): Stage 4 — tests + docs + tasks tracking - tests/Unit/Service/RoleFeaturePermissionServiceTest.php — table-driven PHPUnit covering the cases the spec calls out: * no-restriction-configured → null (REQ-RFP-009) * single group → allowed set * multi-group union widens (REQ-RFP-005) * deny-wins rule (REQ-RFP-005 scenario 2) * fallback to 'default' group when no group_order match (REQ-RFP-009) * isWidgetAllowed true when unconfigured (backwards-compat) * seedLayoutFromRoleDefaults no-op when dashboard already has placements (REQ-RFP-002 scenario 3) * seedLayoutFromRoleDefaults creates placements when empty - docs/role-based-content.md — admin-facing reference: data model, multi-group resolution algorithm with worked example, admin UI tour, REST API surface, initial-state contract, migration notes. - openspec/changes/role-based-content/tasks.md — 23 of ~40 boxes ticked (sections 1-7, parts of 8-11, 15.1). Banner at top of tasks.md notes the OpenRegister→native translation and which tasks are deferred. Deferred to follow-up commits / human pass: - 0.x dedup check (low risk, can be retro-confirmed) - 4.2-4.3 per-widget URL 403 + audit (no per-widget endpoint to gate; audit log facility doesn't exist in mydash today) - 8.2 try/catch wrapping in card-library frontend - 9.3 RoleLayoutDefault admin UI (API exists; UI ships in follow-up) - 11.2-11.3 controller test scaffolding - 12.x Postman/Newman integration suite - 13.x Playwright browser tests - 14.x manual smoke tests - 15.2 admin UI screenshot - 16.x quality gates — CI will surface anything Refs #91 * fix(role-based-content): post-rebase quality cleanup After cherry-picking the 5 stages of PR #95 onto current development, the freshly-applied code triggered phpcs / phpstan errors that the original branch never hit (dev has tightened the quality gate since May 1). Fixes: - PageController: hoist the inline-IF in `setAllowedWidgets()` to a guarded local var; add the missing `$roleFeaturePerm` docblock parameter. - WidgetApiController: drop the unused `$logger` constructor parameter (PHPStan: never read) + its import. - DashboardService: docblock parameter ordering now matches the constructor (RoleFeaturePermissionService entry sits between Logger and the trailing nullables). - RoleFeaturePermissionApiController: switch every `requireAdmin()` guard from inline-IF assignment to the canonical two-line form used by AdminController / ConfluenceImportController. - RoleFeaturePermission entity: rewrite the three `is_array(...) ? array_values(...) : []` ternaries as guarded blocks (PHPCS: inline-IF banned). - RoleFeaturePermissionService: same ternary-to-block rewrite for the description / allowedWidgets / deniedWidgets / priorityWeights / isCompulsory branches; mark the two `getId() === null` upsert checks with `// @phpstan-ignore-next-line identical.alwaysFalse` (the docblock claims `int` but Entity allows null until insert); add the missing service short-description. - RoleFeaturePermissionMapper / RoleLayoutDefaultMapper: add the missing `find(int $id): RoleFeaturePermission|RoleLayoutDefault` methods so the service's `deletePermission` / `deleteLayoutDefault` paths resolve (PHPStan: undefined method). - roleFeaturePermissions.js store: drop the unused `generateOcsUrl` import (eslint no-unused-vars). Tests: 846/846 vitest pass; phpcs + phpstan + eslint all green.

Implement: Role-based dashboard content and defaults #91

Description

OpenSpec Change: role-based-content

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions