Restrict Access to Apps/API Keys

[nelsonic]

At present we allow anyone to view any App/API Key:

auth/lib/auth_web/controllers/app_controller.ex

Lines 27 to 59 in 87c52d6

	def show(conn, %{"id" => id}) do
	app = App.get_app!(id)
	render(conn, "show.html", app: app)
	end
	def edit(conn, %{"id" => id}) do
	app = App.get_app!(id)
	changeset = App.change_app(app)
	render(conn, "edit.html", app: app, changeset: changeset)
	end
	def update(conn, %{"id" => id, "app" => app_params}) do
	app = App.get_app!(id)
	case App.update_app(app, app_params) do
	{:ok, app} ->
	conn
	|> put_flash(:info, "App updated successfully.")
	|> redirect(to: Routes.app_path(conn, :show, app))
	{:error, %Ecto.Changeset{} = changeset} ->
	render(conn, "edit.html", app: app, changeset: changeset)
	end
	end
	def delete(conn, %{"id" => id}) do
	app = App.get_app!(id)
	{:ok, _app} = App.delete_app(app)
	conn
	|> put_flash(:info, "App deleted successfully.")
	|> redirect(to: Routes.app_path(conn, :index))
	end

These are the default CRUD functions created in #95
We need to allow only the person that created the App/API Key (and the superadmin) to view/edit/update/delete it.

Todo

• Create a helper function that automatically rejects the request if person is not allowed to view/edit/update/delete the content.

[nelsonic]

This is what I will be working on tomorrow morning ... ⏳
But for now ... 😴

[nelsonic]

A non-admin person should only be able to see their own App(s) http://localhost:4000/apps

Currently, they can see everyone's Apps ...
Let's fix that!

[nelsonic]

non-admin can only see their own app:

Admin can see all apps:

might add some detail to this table to help differentiate apps in the future.
But for now the restriction works which is what I wanted/needed. ✅

[th0mas]

Access to roles is not currently restricted, allowing anyone to create/edit/delete roles for any app - I'm guessing this isn't intended behaviour?

[nelsonic]

Hi @th0mas! longer-term we don't want everyone seeing everyone else's roles, agreed.
If you don't mind, please open a new/separate issue specific to Roles so we can address it.
Thanks! ☀️