More work to straighten out permissions

Ean Schuessler
Showing 2 changed files with 24 additions and 17 deletions
data/McpSecuritySeedData.xml
service/McpServices.xml
--- a/data/McpSecuritySeedData.xml
View file @caff968
+++ b/data/McpSecuritySeedData.xml
View file @caff968
@@ -22,6 +22,7 @@
    <moqui.security.ArtifactGroup artifactGroupId="McpRestPaths" description="MCP REST API Paths"/>
    <moqui.security.ArtifactGroup artifactGroupId="McpScreenTransitions" description="MCP Screen Transitions"/>
    <moqui.security.ArtifactGroup artifactGroupId="McpBusinessServices" description="MCP Essential Business Services"/>
+    <moqui.security.ArtifactGroup artifactGroupId="McpSecurityEntities" description="Security entities needed for permission checks"/>
    <!-- MCP Artifact Group Members -->
    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="McpServices.*" artifactTypeEnumId="AT_SERVICE"/>
@@ -63,6 +64,10 @@
    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="moqui.server.Visit" artifactTypeEnumId="AT_ENTITY"/>
    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="create#moqui.server.Visit" artifactTypeEnumId="AT_ENTITY"/>
    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="update#moqui.server.Visit" artifactTypeEnumId="AT_ENTITY"/>
+    <!-- Security Entity Access for permission checking -->
+    <moqui.security.ArtifactGroupMember artifactGroupId="McpSecurityEntities" artifactName="moqui.security.ArtifactGroupMember" artifactTypeEnumId="AT_ENTITY"/>
+    <moqui.security.ArtifactGroupMember artifactGroupId="McpSecurityEntities" artifactName="moqui.security.UserGroupMember" artifactTypeEnumId="AT_ENTITY"/>
+    <moqui.security.ArtifactGroupMember artifactGroupId="McpSecurityEntities" artifactName="moqui.security.ArtifactAuthz" artifactTypeEnumId="AT_ENTITY"/>
    <!-- Basic Services -->
    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="org.moqui.impl.BasicServices.get#ServerNodeInfo" artifactTypeEnumId="AT_SERVICE"/>
    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="org.moqui.impl.BasicServices.get#SystemInfo" artifactTypeEnumId="AT_SERVICE"/>
@@ -74,20 +79,26 @@
    <moqui.security.ArtifactAuthz userGroupId="McpUser" artifactGroupId="McpRestPaths" authzTypeEnumId="AUTHZT_ALLOW" authzActionEnumId="AUTHZA_ALL"/>
    <moqui.security.ArtifactAuthz userGroupId="McpUser" artifactGroupId="McpScreenTransitions" authzTypeEnumId="AUTHZT_ALLOW" authzActionEnumId="AUTHZA_ALL"/>
+    <!-- Give ALL users access to security entities needed for permission checks -->
+    <moqui.security.ArtifactAuthz userGroupId="ALL_USERS" artifactGroupId="McpSecurityEntities" authzTypeEnumId="AUTHZT_ALLOW" authzActionEnumId="AUTHZA_ALL"/>
+    <!-- Ensure ADMIN user always has access to security entities needed for permission checks -->
+    <moqui.security.ArtifactAuthz userGroupId="ADMIN" artifactGroupId="McpServices" authzTypeEnumId="AUTHZT_ALWAYS" authzActionEnumId="AUTHZA_ALL"/>
    <!-- MCP Business Group Authz -->
    <moqui.security.ArtifactAuthz userGroupId="MCP_BUSINESS" artifactGroupId="McpServices" authzTypeEnumId="AUTHZT_ALLOW" authzActionEnumId="AUTHZA_ALL"/>
    <moqui.security.ArtifactAuthz userGroupId="MCP_BUSINESS" artifactGroupId="McpBusinessServices" authzTypeEnumId="AUTHZT_ALLOW" authzActionEnumId="AUTHZA_ALL"/>
    <moqui.security.ArtifactAuthz userGroupId="MCP_BUSINESS" artifactGroupId="McpRestPaths" authzTypeEnumId="AUTHZT_ALLOW" authzActionEnumId="AUTHZA_ALL"/>
    <!-- MCP User Accounts -->
    <moqui.security.UserAccount userId="MCP_USER" username="mcp-user" currentPassword="16ac58bbfa332c1c55bd98b53e60720bfa90d394" passwordHashType="SHA"/>
    <moqui.security.UserAccount userId="MCP_BUSINESS" username="mcp-business" currentPassword="16ac58bbfa332c1c55bd98b53e60720bfa90d394" passwordHashType="SHA"/>
-    <moqui.security.UserAccount userId="ADMIN" username="ADMIN" currentPassword="16ac58bbfa332c1c55bd98b53e60720bfa90d394" passwordHashType="SHA"/>
    <!-- Add MCP users to MCP user groups -->
    <moqui.security.UserGroupMember userGroupId="McpUser" userId="MCP_USER" fromDate="2025-01-01 00:00:00.000"/>
    <moqui.security.UserGroupMember userGroupId="MCP_BUSINESS" userId="MCP_BUSINESS" fromDate="2025-01-01 00:00:00.000"/>
-    <moqui.security.UserGroupMember userGroupId="McpUser" userId="ADMIN" fromDate="2025-01-01 00:00:00.000"/>
+    <!-- ADMIN user doesn't need to be in MCP groups - should have full access by default -->
    <!-- Add existing demo users to MCP business group for focused testing -->
    <moqui.security.UserGroupMember userGroupId="MCP_BUSINESS" userId="ORG_ZIZI_JD" fromDate="2025-01-01 00:00:00.000"/>
--- a/service/McpServices.xml
View file @caff968
+++ b/service/McpServices.xml
View file @caff968
@@ -575,24 +575,20 @@
                // Store original username for permission checks
                def originalUsername = ec.user.username
-                // Get user's accessible entities in a single query for efficiency
+                // Get user's accessible entities using Moqui's built-in permission checking
                def userAccessibleEntities = null as Set<String>
-                // Query ArtifactGroupMembers directly to get all entities user can access
-                UserInfo adminUserInfo = null
+                // Get all entity names and filter using Moqui's permission system
-                try {
+                def allEntityNames = ec.entity.getAllEntityNames()
-                    adminUserInfo = ec.user.pushUser("ADMIN")
+                userAccessibleEntities = []
-                    def artifactGroupMembers = ec.entity.find("moqui.security.ArtifactGroupMember")
-                        .condition("artifactTypeEnumId", "AT_ENTITY")
+                for (entityName in allEntityNames) {
-                        .condition("userGroupId", ec.user.getUserGroupsIdSet().collect { it.userGroupId })
+                    // Use Moqui's built-in permission checking
-                        .selectFields("artifactName")
+                    if (ec.user.hasPermission("entity:${entityName}".toString())) {
-                        .distinct(true)
+                        userAccessibleEntities << entityName
-                        .list()
-                    userAccessibleEntities = artifactGroupMembers.collect { it.artifactName } as Set<String>
-                } finally {
-                    if (adminUserInfo != null) {
-                        ec.user.popUser()
                    }
                }
+                userAccessibleEntities = userAccessibleEntities as Set<String>
                // Helper function to check if user has permission to an entity
                def userHasEntityPermission = { entityName ->