feat(constance): let admins restrict anonymous user permissions DEV-2470#7286
feat(constance): let admins restrict anonymous user permissions DEV-2470#7286platreth wants to merge 1 commit into
Conversation
Add a superuser-editable Constance setting ALLOWED_ANONYMOUS_PERMISSIONS that can further restrict which permissions anonymous (public) users may hold. The hard-coded settings.ALLOWED_ANONYMOUS_PERMISSIONS remains the absolute ceiling; the Constance value can only remove permissions from it, never add. A new get_allowed_anonymous_permissions() helper returns the intersection of the ceiling and the configured subset, and all read sites now go through it.
743dcaf to
80b88c3
Compare
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| from kpi.utils.strings import split_lines_to_list | ||
|
|
||
| ceiling = set(settings.ALLOWED_ANONYMOUS_PERMISSIONS) | ||
| configured = set(split_lines_to_list(config.ALLOWED_ANONYMOUS_PERMISSIONS)) |
There was a problem hiding this comment.
When an administrator removes a permission after a deployed form has already granted it anonymously, this intersection changes KPI authorization without running the permission-removal flow that updates KC/XForm access flags. The deployment endpoint can therefore remain public until another operation explicitly reconciles those flags.
| 'ALLOWED_ANONYMOUS_PERMISSIONS': ( | ||
| '\n'.join(ALLOWED_ANONYMOUS_PERMISSIONS), | ||
| 'Permissions grantable to anonymous (public) users\nOne per line. ' | ||
| 'Can only narrow the server maximum; entries outside it are ignored.', |
There was a problem hiding this comment.
These new descriptions are displayed in the Constance admin UI but are fixed English strings. Repository policy requires user-visible backend text constants to use the translation wrapper, so administrators using another locale will still see these labels in English.
Rule Used: All text constants on both backend and frontend mu... (source)
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
1 participant
📣 Summary
Server administrators can now limit which permissions may be granted to anonymous (public) users — for example, letting a form be viewed publicly while preventing its submitted data from being shared publicly.
📖 Description
Previously the set of permissions that could be handed to anonymous users was fixed for the whole server. A superuser can now narrow that set from the server configuration (Constance settings), for instance by removing "view submissions" so that public data sharing is no longer possible on that server. The server's built-in maximum still applies, so this can only make public access more restrictive, never broader.
💭 Notes
ALLOWED_ANONYMOUS_PERMISSIONS(one-per-line, in the Security fieldset). Default equals the existingsettings.ALLOWED_ANONYMOUS_PERMISSIONS, so behaviour is unchanged out of the box.settings.ALLOWED_ANONYMOUS_PERMISSIONS(hard ceiling)∩the configured list, computed by a newget_allowed_anonymous_permissions()helper. It can only subtract from the ceiling; a permission listed outside the ceiling is ignored.settingsdirectly.👀 Preview steps
/admin/constance/config/, find ALLOWED_ANONYMOUS_PERMISSIONS under Security, delete thekpi.view_submissionsline, and saveview_submissionsto the anonymous user) → it is rejected (standard "Failed to update permissions" toast)