Pass available permissions to getPermissionsForUser

[fraxachun]

Description

Applications sometimes (in our case most of the time) have two types of users:

• Admins, which have every permission
• Users, who have every permission except userPermissions

The problem with the current implementation is that if a permission is added, it also has to be allowlisted in access-control.service.ts. This is often forgotten, leading to unexpected behaviour.

This PR allows to use a Denylist instead of an Allowlist.

Discussion

This might violate the least privilege principle. If we decide against this approach, I think we will need another solution to handle permissions in code (e.g. we start to define them statically again).

[nsams]

Can you implement such a Denylist in demo that you think we would use in such applications?

[fraxachun]

Can you implement such a Denylist in demo that you think we would use in such applications?

f151ad8

[johnnyomair]

This might violate the least privilege principle. If we decide against this approach, I think we will need another solution to handle permissions in code (e.g. we start to define them statically again).

@dkarnutsch @max-debug022 what do you think?

[max-debug022]

This might violate the least privilege principle. If we decide against this approach, I think we will need another solution to handle permissions in code (e.g. we start to define them statically again).

@dkarnutsch @max-debug022 what do you think?

I would not recommend allowing a denylist in this matter. I fear it could increase the risk of security vulnerabilities, particularly those related to broken access controls. From a security point of view, it is preferable to wait for users to request additional permissions. As I see it, users are very unlikely to complain if they have more permissions than necessary.

If there is no way around it, I strongly recommend implementing additional safeguards. For example, permissions could be automatically revoked after a certain timeframe (Month, Year, 6 Months, ...) unless explicitly disabled.