feat: restricted permissions for image actions [WD-18905]

[mas-who]

Done

• handling of image related actions documented here

QA

1. Run the LXD-UI:
   • On the demo server via the link posted by @webteam-app below. This is only available for PRs created by collaborators of the repo. Ask @mas-who or @edlerd for access.
   • With a local copy of this branch, build and run as described in the docs.
2. Perform the following QA steps:
   • Check that the UI handles images related permission restrictions according to actions documented here

[webteam-app]

Demo

Jenkins

demos.haus

[edlerd]

Thx for making the entitlement lookups consistent. Only two questions below left, then this should be good to go.

[edlerd]

code LGTM

[mas-who]

code LGTM

Thanks, are we not going to do QA?

[edlerd]

An open issue:
Given a user has "project default image_manager", but not "project default viewer", then we fail to identify if the user has the image creation permission.

[mas-who]

An open issue: Given a user has "project default image_manager", but not "project default viewer", then we fail to identify if the user has the image creation permission.

I believe if the user does not have project default viewer they will not be able to see anything in the UI for project default. This is related to this task.

[edlerd]

I believe if the user does not have project default viewer they will not be able to see anything in the UI for project default. This is related to this task.

Interestingly, the image list was visible without the project viewer permission. But the upload image button was disabled, because we fail to figure out the user has that permission.

[mas-who]

I believe if the user does not have project default viewer they will not be able to see anything in the UI for project default. This is related to this task.

Interestingly, the image list was visible without the project viewer permission. But the upload image button was disabled, because we fail to figure out the user has that permission.

I think that's probably because in App.tsx, ImageList is not wrapped with ProjectLoader. It's interesting though, we can fetch images with the all-project query param, so it can be a non-project specific page. Currently, to upload an image, it is dependent on the current project that we have selected. Perhaps the upload image form should have a project selector, that way the list of project options would be governed by project <project> can_view permission. wdyt? Should it be part of this PR?

[edlerd]

I think that's probably because in App.tsx, ImageList is not wrapped with ProjectLoader. It's interesting though, we can fetch images with the all-project query param, so it can be a non-project specific page. Currently, to upload an image, it is dependent on the current project that we have selected. Perhaps the upload image form should have a project selector, that way the list of project options would be governed by project <project> can_view permission. wdyt? Should it be part of this PR?

I wouldn't change it now. I am also not sure if it is the right thing to do. Images are project specific, after all.

The project viewer permission is mandatory to have image permissions correctly applied. Maybe mention it as an issue in the doc you created. I am fine with keeping things as they are now.

[edlerd]

Apart from the issue mentioned above, QA LGTM as well.

[mas-who]

I think that's probably because in App.tsx, ImageList is not wrapped with ProjectLoader. It's interesting though, we can fetch images with the all-project query param, so it can be a non-project specific page. Currently, to upload an image, it is dependent on the current project that we have selected. Perhaps the upload image form should have a project selector, that way the list of project options would be governed by project <project> can_view permission. wdyt? Should it be part of this PR?

I wouldn't change it now. I am also not sure if it is the right thing to do. Images are project specific, after all.

The project viewer permission is mandatory to have image permissions correctly applied. Maybe mention it as an issue in the doc you created. I am fine with keeping things as they are now.

Okay sure, when it comes to permissions, I think we may run into a few places where the current UI structure may need to be updated/changed/improved. I've documented the above issue in the sheet for reference.

[edlerd]

LGTM 👍