Skip to content

F permission checks

Henrik tom Wörden requested to merge f-permission-checks into dev

Summary

Previously, when ever a result set was composed in SQL (also intermediate ones) for each contained entity it was checked whether the user has permissions to retrieve the entities. And this was done by creating a sparse entity object of each ID in the result set. Now, only different ACL are checked and this without creating any sparse entity.

Focus

The two filterEntitiesWithoutRetrievePermissions functions were combined. The set of ACL that needs to be considered is done on SQL side.

Please also check whether the exception handling is done now.

Test Environment

  • Performance improvement was already verified.
  • It is important that permissions are still checked correctly. Please test manually that
    • No entity without retrieve permission is returned
    • No information of entities without retrieve permissions can be accessed in subqueries.

Check List for the Author

Please, prepare your MR for a review. Be sure to write a summary and a focus and create gitlab comments for the reviewer. They should guide the reviewer through the changes, explain your changes and also point out open questions. For further good practices have a look at our review guidelines

  • All automated tests pass
  • Reference related issues
  • Up-to-date CHANGELOG.md (or not necessary)
  • Annotations in code (Gitlab comments)
    • Intent of new code
    • Problems with old code
    • Why this implementation?

Check List for the Reviewer

  • I understand the intent of this MR
  • All automated tests pass
  • Up-to-date CHANGELOG.md (or not necessary)
  • The test environment setup works and the intended behavior is reproducible in the test environment
  • In-code documentation and comments are up-to-date.
  • Check: Are there specifications? Are they satisfied?

For further good practices have a look at our review guidelines.

Edited by Timm Fitschen

Merge request reports