Permissions

[waldo1001]

The idea is to set up some guidelines on how to handle "permissions" (since v21).

What I would like to mention:

1. do NOT use the built-in VSCode commands to generate and update one PermissionSet file
2. always create an ADMIN and READONLY permissionset for all tables
3. split permissionsets for functional area (possibly multiple per app)
4. never add permissions for anything other than TableData
5. add your "ADMIN" permission Sets to the "D365 Full Access" with a permissionsetextension
6. add your "READONLY" permissionset to whatever fits the functionality

[NKarolak]

Great idea!
Reg. 1, 2 and 4: Please also explain why (not).

It would be great to have short instruction on this: I am working on app that also has objects and split permission sets.
Now I am adding new objects to the app. How should I add them to the existing permission sets? Is there a tool I should use?

[waldo1001]

1_
it produces the most useless file ever.

2_
it makes sense that users can set up read-only and/or admin users for specific roles. It makes you most flexible, without even thinking about it

4_
I'm obviously talking products here. Why would I block/give access through anything other than data. This is again: be as
flexible as you can without thinking about it. Users have the freedom to set up premissionsets based on other object types 🤷‍♀️. Also: it's how MS does it as well ;-).

[waldo1001]

I don't know about tooling - we're simply doing it "while" developing.

[NKarolak]

I didn't mean you to explain it right now ;-)

Tooling was just an idea. If there is only a manual (but easy) way, then it would be helpful to describe it anyway - since we are talking about guidelines :-)

[waldo1001]

🙈

[NAVFreak]

4. never add permissions for anything other than TableData

If I understand you correctly we can ignore this rule LC0015 - All application objects should be covered by at least one permission set in the extension in Business Central Linter Cop?

[waldo1001]

That's a rule I don't agree with indeed. ;-)

[fvet]

Here's some extracts from our internal wiki ;)

"Permissionset Extension D365 BUS FULL ACCESS": {
        "prefix": "rpermissionsetExtFull (ALTB)",
        "body": [
            "permissionsetextension ${1:Id} \"${2:Prefix} D365 BUS FULL ACCESS\" extends \"D365 BUS FULL ACCESS\"",
            "{",
            "\tIncludedPermissionSets = \"${2:Prefix} ${3:ShortAppName}, Setup\", \"${2:Prefix} ${3:ShortAppName}, Edit\";",
            "}"
        ],
        "description": "Permissionset Extension D365 BUS FULL ACCESS"
    },
    "Permissionset Extension D365 SETUP": {
        "prefix": "rpermissionsetExtSetup (ALTB)",
        "body": [
            "permissionsetextension ${1:Id} \"${2:Prefix} D365 SETUP\" extends \"D365 SETUP\"",
            "{",
            "\tIncludedPermissionSets = \"${2:Prefix} ${3:ShortAppName}, Setup\";",
            "}"
        ],
        "description": "Permissionset Extension D365 SETUP"
    },
    "Permissionset Edit": {
        "prefix": "rpermissionsetEdit (ALTB)",
        "body": [
            "permissionset ${1:Id} \"${2:Prefix} ${3:ShortAppName}, Edit\"",
            "{",
            "\tAccess = Internal;",
            "\tAssignable = true;",
            "\tCaption = 'Dyn, Edit ${3:ShortAppName}', Locked = true;",
            "\tIncludedPermissionSets = \"${2:Prefix} ${3:ShortAppName}, View\";",
            "",
            "\t$0// Permissions = tabledata \"Transaction Table\" = IMD;",
            "",
            "\t// Each transaction table should be added here with IMD",
            "\t// tabledata \"Transaction Table\" = IMD",
            "}"
        ],
        "description": "Permissionset Edit"
    },
    "Permissionset Setup": {
        "prefix": "rpermissionsetSetup (ALTB)",
        "body": [
            "permissionset ${1:Id} \"${2:Prefix} ${3:ShortAppName}, Setup\"",
            "{",
            "\tAccess = Internal;",
            "\tAssignable = true;",
            "\tCaption = 'Dyn, Setup ${3:ShortAppName}', Locked = true;",
            "",
            "\t$0// Permissions = tabledata \"Setup Table\" = RIMD;",
            "",
            "\t// Each setup table should be added here with RIMD",
            "\t// tabledata \"Setup Table\" = RIMD",
            "}"
        ],
        "description": "Permissionset Setup"
    },
    "Permissionset View": {
        "prefix": "rpermissionsetView (ALTB)",
        "body": [
            "permissionset ${1:Id} \"${2:Prefix} ${3:ShortAppName}, View\"",
            "{",
            "\tAccess = Internal;",
            "\tAssignable = true;",
            "\tCaption = 'Dyn, View ${3:ShortAppName}', Locked = true;",            
            "",
            "\t$0// Permissions = tabledata \"Table\" = R;",
            "",
            "\t// Each table should be added here with R",
            "\t// tabledata \"Table\" = R",
            "}"
        ],
        "description": "Permissionset View"
    }

PS: We have the LC0015 rule disabled as well in our global.ruleset.json.

{
    "id": "LC0015",
    "action": "None",
    "justification": "Covered by AS0103"
},    

[waldo1001]

Wow, totally missed this - this is great, @fvet.

[waldo1001]

One to add:
https://twitter.com/KarolakNatalie/status/1635906254110433282?s=20