Management API: Allow Authorization override for "admin"

[paullatzelsperger]

Feature Request

All Management API endpoints are either restricted to the "admin" role, or are only available to the owner (=participant) of the resource.

In addition, we need a way for a (configurable) user role to override/supersede user permissions. That means, that a certain role, e.g. the "admin", can access/modify/read resources even if they are not the original owner.

Which Areas Would Be Affected?

AuthorizationService

Why Is the Feature Desired?

Super user roles should be able to access all resources.

Solution Proposal

Have a check in the AuthorizationService, that allows for one or several configurable roles to override user permissions. This will most likely require a downcast of the Principal:

@Override
public ServiceResult<Void> isAuthorized(Principal principal, String resourceId, Class<?> resourceClass) {

  if (principal instanceof User user) {
    if (user.getRoles().contains(ROLE_ADMIN)) {
      return ServiceResult.success();
    }
  }
  // ... other checks
}