WIP

OVERVIEW

...

Since we need to have read-only or write access to specific sections of the System Console , we will define a new set of READ + WRITE `WRITE` permissions for each of the ten main sections, as well as to some of the sub-sections that some of the new roles need special access.

...

Note: For User Manager role above, for the “User Management” section we could have had only the PERMISSION_READ_SYSCONSOLE_USERMANAGEMENT and PERMISSION_WRITE_SYSCONSOLE_USERMANAGEMENTpermissions. The reason we have more permissions, to subsections, is that in the future we will project to have variants of this role that will have some of their subsections WRITE permissions removed.

...

Most API calls that were previously gated by the MANAGE_SYSTEM permission are now gated by the READ_* permissions for the get() calls and WRITE_* permission for the create, patch and update calls.
If we need to have more granular access to an API method that corresponds to the functionality of a sub-section in the System Console (like in the User Manager case), we will gate those calls on a case by case (a single panel functionality in the System Console panel can map to one or more API calls).

Permissions

See changes detailed above

Schema

No schema changes

REST API

The following API methods will have their gating functionality changes, as follows:

Performance

No performance degradation expected.

Plugins

CREDITS

Thanks to