[Pending] Request Permissions from the Backend

[davelsio]

Summary

Currently, the Zendro frontend duplicates the server strategy for ACL rules. This means that an acl-rules file that exists in both the backend and frontend, is parsed by the acl package, and computed permissions loaded into memory.

Maintaining two sources of truth for ACL rules can potentially lead to a desynchronization problem, is a cause of code duplication, and increases bundle size by including a redundant acl package.

Proposed Enhancements

Request permissions from the backend

In the frontend, current user authorization cannot be known at build time. Permissions must be computed at login-time, making it a valid strategy to request them from the server instead of hard-coding ACL rules at build-time.

• This would eliminate code duplication and potential inconsistencies between client-side and server-side rules.
• Login flow would remain the same, only receive additional data (token, permissions, other...).
• We could shave off some bundle size by removing the acl package and related code to compute permissions (this also includes performance improvements by not creating a MemoryBackend instance in the browser).
• This creates a more natural authentication + authorization behavior, moving extraneous server functionality away from the client.

Permissions are stored, but not persisted

Permissions would still be stored in memory after login, but unlike in the current implementation, not persisted in local storage. Instead, when a session is loaded from storage, a new request would be made to the server to receive an updated list of permissions.

• It may prevent a rare issue where the user permissions have changed between sessions, but the frontend has not been notified and will now display dysfunctional parts in the UI.
• Loading user permissions in the store when reloading into an existing session would need to be asynchronous. Achieving this seamlessly might not be trivial.