add support for API permissions at the UI layer - including ability to delegate user, role, profile management

Oqtane.Client/Extensions/OqtaneServiceCollectionExtensions.cs

@@ -49,7 +49,6 @@ public static IServiceCollection AddOqtaneScopedServices(this IServiceCollection
             services.AddScoped<IUrlMappingService, UrlMappingService>();
             services.AddScoped<IVisitorService, VisitorService>();
             services.AddScoped<ISyncService, SyncService>();
-            services.AddScoped<IApiService, ApiService>();
 
             return services;
         }

Oqtane.Client/Modules/Admin/Dashboard/Index.razor

@@ -20,13 +20,16 @@
 </div>
 
 @code {
-    private List<Page> _pages;
+	private List<Page> _pages;
 
-    public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.Admin;
+	public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.Anonymous;
 
-    protected override void OnInitialized()
-    {
-        var admin = PageState.Pages.FirstOrDefault(item => item.Path == "admin");
-        _pages = PageState.Pages.Where(item => item.ParentId == admin?.PageId).ToList();
+	protected override void OnInitialized()
+	{
+		var admin = PageState.Pages.FirstOrDefault(item => item.Path == "admin");
+		if (admin != null)
+		{
+			_pages = PageState.Pages.Where(item => item.ParentId == admin?.PageId).ToList();
+		}
     }
 }

Oqtane.Client/Modules/Admin/ModuleCreator/Index.razor

@@ -131,7 +131,7 @@ else
 					moduleDefinition = await ModuleDefinitionService.CreateModuleDefinitionAsync(moduleDefinition);
 
 					var settings = await SettingService.GetModuleSettingsAsync(ModuleState.ModuleId);
-					SettingService.SetSetting(settings, "ModuleDefinitionName", moduleDefinition.ModuleDefinitionName);
+					settings = SettingService.SetSetting(settings, "ModuleDefinitionName", moduleDefinition.ModuleDefinitionName);
 					await SettingService.UpdateModuleSettingsAsync(settings, ModuleState.ModuleId);
 
 					GetLocation();

Oqtane.Client/Modules/Admin/Pages/Add.razor

@@ -157,7 +157,8 @@
             </TabPanel>
         }
     </TabStrip>
-    <button type="button" class="btn btn-success" @onclick="SavePage">@SharedLocalizer["Save"]</button>
+	<br />
+	<button type="button" class="btn btn-success" @onclick="SavePage">@SharedLocalizer["Save"]</button>
     <button type="button" class="btn btn-secondary" @onclick="Cancel">@SharedLocalizer["Cancel"]</button>
 </form>
 

Oqtane.Client/Modules/Admin/Pages/Edit.razor

@@ -148,7 +148,8 @@
                         </div>
                     </div>
                 </Section>
-                <br /><br />
+                <br />
+				<br />
                 <AuditInfo CreatedBy="@_createdby" CreatedOn="@_createdon" ModifiedBy="@_modifiedby" ModifiedOn="@_modifiedon" DeletedBy="@_deletedby" DeletedOn="@_deletedon"></AuditInfo>
             }
         </TabPanel>
@@ -189,7 +190,8 @@
             <br />
         }
     </TabStrip>
-    <button type="button" class="btn btn-success" @onclick="SavePage">@SharedLocalizer["Save"]</button>
+	<br />
+	<button type="button" class="btn btn-success" @onclick="SavePage">@SharedLocalizer["Save"]</button>
     <button type="button" class="btn btn-secondary" @onclick="Cancel">@SharedLocalizer["Cancel"]</button>
 </form>
 

Oqtane.Client/Modules/Admin/Profiles/ModuleInfo.cs

@@ -0,0 +1,19 @@
+using Oqtane.Documentation;
+using Oqtane.Models;
+using Oqtane.Shared;
+
+namespace Oqtane.Modules.Admin.Profiles
+{
+    [PrivateApi("Mark this as private, since it's not very useful in the public docs")]
+    public class ModuleInfo : IModule
+    {
+        public ModuleDefinition ModuleDefinition => new ModuleDefinition
+        {
+            Name = "Profiles",
+            Description = "Manage Profiles",
+            Categories = "Admin",
+            Version = Constants.Version,
+            PermissionNames = $"{PermissionNames.View},{PermissionNames.Edit},{EntityNames.Profile}:{PermissionNames.Write}:{RoleNames.Admin}"
+        };
+    }
+}

Oqtane.Client/Modules/Admin/Roles/Add.razor

@@ -42,7 +42,7 @@
     private string _description = string.Empty;
     private string _isautoassigned = "False";
 
-    public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.Admin;
+    public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.Edit;
 
     private async Task SaveRole()
     {

Oqtane.Client/Modules/Admin/Roles/Edit.razor

@@ -49,7 +49,7 @@
     private string _modifiedby;
     private DateTime _modifiedon;
 
-    public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.Admin;
+    public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.Edit;
 
     protected override async Task OnInitializedAsync()
     {

Oqtane.Client/Modules/Admin/Roles/Index.razor

@@ -10,7 +10,7 @@
 }
 else
 {
-    <ActionLink Action="Add" Text="Add Role" ResourceKey="AddRole" />
+	<ActionLink Action="Add" Text="Add Role" Security="SecurityAccessLevel.Edit" ResourceKey="AddRole" />
 
     <Pager Items="@_roles">
         <Header>
@@ -20,9 +20,9 @@ else
             <th>@SharedLocalizer["Name"]</th>
         </Header>
         <Row>
-            <td><ActionLink Action="Edit" Parameters="@($"id=" + context.RoleId.ToString())" Disabled="@(context.IsSystem)" ResourceKey="Edit" /></td>
-            <td><ActionDialog Header="Delete Role" Message="@string.Format(Localizer["Confirm.DeleteUser"], context.Name)" Action="Delete" Security="SecurityAccessLevel.Admin" Class="btn btn-danger" OnClick="@(async () => await DeleteRole(context))" Disabled="@(context.IsSystem)" ResourceKey="DeleteRole" /></td>
-            <td><ActionLink Action="Users" Parameters="@($"id=" + context.RoleId.ToString())" ResourceKey="Users" /></td>
+			<td><ActionLink Action="Edit" Parameters="@($"id=" + context.RoleId.ToString())" Security="SecurityAccessLevel.Edit" Disabled="@(context.IsSystem)" ResourceKey="Edit" /></td>
+            <td><ActionDialog Header="Delete Role" Message="@string.Format(Localizer["Confirm.DeleteUser"], context.Name)" Action="Delete" Security="SecurityAccessLevel.Edit" Class="btn btn-danger" OnClick="@(async () => await DeleteRole(context))" Disabled="@(context.IsSystem)" ResourceKey="DeleteRole" /></td>
+			<td><ActionLink Action="Users" Parameters="@($"id=" + context.RoleId.ToString())" Security="SecurityAccessLevel.Edit" ResourceKey="Users" /></td>
             <td>@context.Name</td>
         </Row>
     </Pager>
@@ -31,7 +31,7 @@ else
 @code {
     private List<Role> _roles;
 
-    public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.Admin;
+    public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.View;
 
     protected override async Task OnParametersSetAsync()
     {

Oqtane.Client/Modules/Admin/Roles/ModuleInfo.cs

@@ -0,0 +1,19 @@
+using Oqtane.Documentation;
+using Oqtane.Models;
+using Oqtane.Shared;
+
+namespace Oqtane.Modules.Admin.Roles
+{
+    [PrivateApi("Mark this as private, since it's not very useful in the public docs")]
+    public class ModuleInfo : IModule
+    {
+        public ModuleDefinition ModuleDefinition => new ModuleDefinition
+        {
+            Name = "Roles",
+            Description = "Manage Roles",
+            Categories = "Admin",
+            Version = Constants.Version,
+            PermissionNames = $"{PermissionNames.View},{PermissionNames.Edit},{EntityNames.Role}:{PermissionNames.Write}:{RoleNames.Admin},{EntityNames.UserRole}:{PermissionNames.Write}:{RoleNames.Admin}"
+        };
+    }
+}