Rework permissions for Security Configuration page
Problematics
For checking permissions for Security Configuration page we're using the SecurityDashboardsPermissions module.
It's handy, but has some limitations:
- The Configuration page is independent of the Security Dashboard feature. This page is also related to the License List page which has separate permission levels from the Security dashboard, as well as the Dependency List page.
- In the future, if some of the features will go to Core, we can have problems dividing permissions for different features
- With adding the POST action to set
auto_fixsetting (permissions Maintainer+),SecurityDashboardsPermissionsmodule doesn't cover this scenario and can be applied only toshowaction.
Suggested implementation plan:
- Create a policy for
read_security_configurationwith permission level Developer+ - Use this policy in
Projects::Security::ConfigurationControllerforshowaction. - Remove usage of
SecurityDashboardsPermissionsfrom the same controller.