| | | 1 | | using Elsa.Authorization; |
| | | 2 | | using Elsa.Permissions; |
| | | 3 | | using JetBrains.Annotations; |
| | | 4 | | |
| | | 5 | | namespace Elsa.UserTasks.Permissions; |
| | | 6 | | |
| | | 7 | | /// <summary> |
| | | 8 | | /// Stable resource names for User Tasks. Endpoints reference these constants rather than string |
| | | 9 | | /// literals, and the descriptors below are declared alongside them so the two cannot drift. |
| | | 10 | | /// </summary> |
| | | 11 | | public static class UserTasksResourcePermissions |
| | | 12 | | { |
| | | 13 | | /// <summary>Work on human tasks: read them, claim them, complete them, and supervise the whole tenant's queue.</sum |
| | | 14 | | public const string UserTasks = "user-tasks"; |
| | | 15 | | |
| | | 16 | | /// <summary>Search the users and groups a task may be assigned to.</summary> |
| | | 17 | | public const string Participants = "user-tasks/participants"; |
| | | 18 | | } |
| | | 19 | | |
| | | 20 | | /// <summary> |
| | | 21 | | /// The non-core verbs User Tasks declares. They live beside the resources they apply to so a call site and |
| | | 22 | | /// the catalog cannot drift apart, and so a policy check cannot spell one differently from the endpoint it |
| | | 23 | | /// guards. |
| | | 24 | | /// </summary> |
| | | 25 | | public static class UserTaskVerbs |
| | | 26 | | { |
| | | 27 | | /// <summary>Take a task from the candidate pool, or give it back. One verb, because releasing is undoing a claim.</ |
| | | 28 | | public const string Claim = "claim"; |
| | | 29 | | |
| | | 30 | | /// <summary>Submit a completion action against a task, resuming the workflow that raised it.</summary> |
| | | 31 | | public const string Complete = "complete"; |
| | | 32 | | |
| | | 33 | | /// <summary>Hand a task to a participant.</summary> |
| | | 34 | | public const string Assign = "assign"; |
| | | 35 | | |
| | | 36 | | /// <summary>End a task without completing it.</summary> |
| | | 37 | | public const string Cancel = "cancel"; |
| | | 38 | | |
| | | 39 | | /// <summary>Issue, list, and revoke guest invitations to a task.</summary> |
| | | 40 | | public const string Invite = "invite"; |
| | | 41 | | |
| | | 42 | | /// <summary> |
| | | 43 | | /// Act across the tenant's whole queue rather than only on tasks you take part in: read every task, |
| | | 44 | | /// assign, reschedule, cancel, see blocked tasks, and retry a failed resolution. |
| | | 45 | | /// </summary> |
| | | 46 | | /// <remarks> |
| | | 47 | | /// Named <c>supervise</c> rather than <c>manage</c> for the reason <c>workflows/runtime:control</c> is |
| | | 48 | | /// not called <c>manage</c> either: it is an elevated tier, not an aggregate of the verbs beside it, and |
| | | 49 | | /// a name that reads like an aggregate invites exactly that misreading. Holding it confers none of |
| | | 50 | | /// <c>claim</c>, <c>complete</c>, <c>assign</c>, <c>cancel</c> or <c>invite</c> — no verb implies another. |
| | | 51 | | /// </remarks> |
| | | 52 | | public const string Supervise = "supervise"; |
| | | 53 | | } |
| | | 54 | | |
| | | 55 | | /// <summary>Contributes the User Tasks resources to the permission catalog.</summary> |
| | | 56 | | [UsedImplicitly] |
| | | 57 | | public sealed class UserTasksResourcePermissionsDescriptorProvider : IPermissionDescriptorProvider |
| | | 58 | | { |
| | | 59 | | /// <inheritdoc /> |
| | | 60 | | public IEnumerable<PermissionDescriptor> GetDescriptors() => |
| | 18 | 61 | | [ |
| | 18 | 62 | | new(UserTasksResourcePermissions.UserTasks, |
| | 18 | 63 | | [CoreVerbs.View, CoreVerbs.Update, UserTaskVerbs.Claim, UserTaskVerbs.Complete, UserTaskVerbs.Assign, UserTa |
| | 18 | 64 | | "User tasks", |
| | 18 | 65 | | "Work on human tasks: read them, claim them, complete them, and supervise the whole tenant's queue.", |
| | 18 | 66 | | "User Tasks"), |
| | 18 | 67 | | new(UserTasksResourcePermissions.Participants, |
| | 18 | 68 | | [CoreVerbs.View], |
| | 18 | 69 | | "User task participants", |
| | 18 | 70 | | "Search the users and groups a task may be assigned to.", |
| | 18 | 71 | | "User Tasks"), |
| | 18 | 72 | | ]; |
| | | 73 | | } |