Concept - Admincentral ACLs migration task

Introduction

Administrator in 4.5 have access to menu items (Admincentral pages) defined via ACLs. Now we have apps instead of pages in Magnolia 5. We have to provide update task to convert these permissions.

Mapping of Pages

Tasks

Convert 4.5 Admincentral ACLs to apps permissions

GOAL: Proper permission to apps, old ACLs removed.

REQUIREMENTS:

• none

STEPS:

1. Run query in userroles workspace for finding all ACL nodes with certain pattern.
2. Convert these ACLs to apps permission.
3. Remove these ACLs from userrolesworkspace.
   • the permissions are in pairs for page and subpage, so we need to remove both permissions (path, path/*)!

EXAMPLE 1 - ACCESS GRANTED:

• the URL ACL for role_admin is set to:  
  
  • path: /.magnolia/configuration
  • permission GET/POST
    
    
• the new app permissions will be:
  
  • permissions
    
    • roles
      
      • role_admin
        
        
• how to create task: 

new ConvertACLtoAppsPermissionTask("name", "description", "/.magnolia/configuration", /modules/ui-admincentral/apps/configuration);

EXAMPLE 2 - ACCESS DENIED:

• the URL ACL for role_editor is set to:  
  
  • path: /.magnolia/configuration
  • permission DENY
    
    
• the new app permissions should be set to:
  
  • permissions
    
    • roles
      
      • superuser

Class: ConvertACLtoAppsPermissionTask

Constructor attributes:

Questions (ehe)

How to map the 4.5 path to M5 application or sub app?:

1. /modules/adminInterface/config/menu/inbox
2. /modules/inplace-templating/
3. /modules/resources/*
4. /modules/adminInterface/config/menu/templating-kit

Answers

      I think any automatically mapping wouldn't be possible. But we know the default old 45 paths for Magnolia pages and corresponding paths to new apps. If someone have a page under different location or   if someone have any custom pages, he would need only to add ConvertACLtoAppsPermissionTask to his ModuleVersionHandler. He need to create new app anyway in case of a custom page and the name of his app can by anything so we can't rely only on app names.

1. If someone have access to /modules/adminInterface/config/menu/inbox then we know he need access to Messages: ConvertACLtoAppsPermissionTask("", "", "/.magnolia/pages/inbox", /modules/messages-app/apps/messages )
   
2. /modules/inplace-templating: ConvertACLtoAppsPermissionTask("", "", "/.magnolia/pages/configuration*", /modules/ui-admincentral/apps/templatesApp)
   
3. /modules/resources/*: ConvertACLtoAppsPermissionTask("", "", "/.magnolia/pages/configuration*", /modules/ui-admincentral/apps/resourcesApp)
4. /modules/adminInterface/config/menu/templating-kit: ConvertACLtoAppsPermissionTask("", "", "/modules/adminInterface/config/menu/templating-kit", /modules/ui-admincentral/config/appLauncherLayoutapps/group/stk)
   
   The tasks should be added in version handlers which bootstrap certain app. Most of them would be in AdmincentralModuleVersionHandler. Others..like tools should be in corresponding modules (for example access to groovy console should be set from groovy version handler).
   We can have parent task which takes map<oldURL, newApp> so we add only one task in case of a lot of URLs to convert.