[FEATURE-REQUEST] Config option to turn off bulk delete about kaffy HOT 6 OPEN

In its current functionality, authorized?/2 wouldn't help you to achieve what you want. It would actually hide the resource (i.e. the schema wouldn't appear in the side menu). I was thinking of extending the function to accept more parameters, but maybe the better option is to add a new authorize/4 function and deprecate authorized?/2.

Let's say you have your %OrgEntitlement resource under the organizations context for example:
The authorize/4 function signature could be:
authorize(conn, context, schema, action)

When users go to the index page, this would be called:
OrgEntitlementAdmin.authorize(conn, "organizations", OrgEntitlement, :index)

When they try to bulk delete:
OrgEntitlementAdmin.authorize(conn, "organizations", OrgEntitlement, :bulk_delete)

Return values could be:

• {:ok, conn}: the user is authorized and the request should proceed (this is the default value).
• {:error, conn} the user is not authorized. conn is sent to the client directly.

This would give much more control to the developer.

from kaffy.

@roryfahy can you please provide more details about your use case? If you can.

from kaffy.

Sure @aesmail. We want to enable the business people to come in and make updates to resources like %OrgEntitlement that dictate how long any member of an Org might have premium access. In cases like this, it would be handy to allow them to delete individual records but don't want to expose a way for them to shoot themselves in the foot by accidentally selecting all of the records and pressing the delete action. As it is now, we are not going to be able to expose the individual delete unless we can avoid the bulk delete. We just consider it too dangerous. Please let me know if I can add any further detail/ I'd be happy to help out with the pr if thats wanted. Thank you for Kaffy, I really appreciate the work you're doing here 🙏

from kaffy.

@roryfahy appreciate the feedback. I'm thinking of making the authorized?/2 function more flexible. Currently, it receives the schema and the conn struct.

Making authorized? receive the context, the resource, the schema, the conn, and the action might make Kaffy way more flexible with permissions.

This might also solve your issue more flexibly. You can just define the function in the admin module and prevent bulk deletion.

This approach might not hide "delete selected records" option though.
However, I feel this might be the way to move forward.

What do you think? @roryfahy

from kaffy.

from kaffy.

oh, yeah that would be really neat. I like that idea.

from kaffy.