HI

in the backoffice things aren't secured by the groups rather the permissions people get by being in the groups.

within a group there are a number of points where permissions can be granted.

1. Sections

If a certain group has access to a section you can test for this.

e.g if you want something only available to people who have access to the settings section:

[Authorize(Policy = AuthorizationPolicies.SectionAccessSettings)]

2. Tree access

this is simliar but when you consider that the tree elements can (with a little effort) be moved between sections, you can say, only people who can see a certain tree.

e.g access to people who can only see the LanguagesTree

[Authorize(Policy = AuthorizationPolicies.TreeAccessLanguages)]

3. Permissions.

in a group you can also assign permissions (such as publish, save, empty recycle bin) you can restrict on this

[Authorize(Policy = AuthorizationPolicies.ContentPermissionEmptyRecycleBin)]

4. Custom permissions

Note: I haven't actually done this to this level, but i think it works like below!

So slightly more involved you can add your own permissions to the list of things a group/user can be given permission to.

firstly you need to create your own IAction, which defines the permission:

/// <summary>
///  My Super high level permission
/// </summary>
public class MySuperPermission: IAction
{
    public char Letter => "W";   // you need to confirm this isn't already in use*
    public bool ShowInNotifier => false;
    public bool CanBePermissionAssigned => true;
    public string Icon => "icon-arrow-left";
    public string Alias => "superHigh";
    public string Category => "My Permissions";
}

then within a composer you need to add your own Custom Policy.

options.AddPolicy("MySuperHighPermission", policy =>
{
    policy.AuthenticationSchemes.Add(backOfficeAuthenticationScheme);
    policy.Requirements.Add(new ContentPermissionsQueryStringRequirement("W"));
 });

then on your controller you can use

[Authorize(Policy = "MySuperHighPermission")]

you would probibly want to replace all these strings with constant values to stop typos

this last one is a bit more involved but in the end your permissions will be fully controllable at a user and group level from within the back office.

• list of currently common permission letters

Cant get the custom one to work.. Have added it and I shows as a options under users permission.

But it's not applying the rule.

[Tree("tools", "dashboards", TreeGroup = "workStationAdminTreeAlias", SortOrder = 0)]
[Authorize(Policy = "InternalDashboard")]
[PluginController("platformWorkStation")]

public class PlatformSectionsComposer : IComposer
{
    public void Compose(IUmbracoBuilder builder)
    {
        builder.Sections().Insert<WorkstationSection>(0);
        builder.Services.AddAuthorization(options 
            => AddSecurityPolicies(options, Constants.Security.BackOfficeAuthenticationType));

    }
    private void AddSecurityPolicies(AuthorizationOptions options, string backOfficeAuthenticationScheme)
    {
        options.AddPolicy("InternalDashboard", policy =>
        {
            policy.AuthenticationSchemes.Add(backOfficeAuthenticationScheme);
            policy.Requirements.Add(new ContentPermissionsQueryStringRequirement('Å'));
        });
    }
}

public class MySuperPermission : IAction
{
    public char Letter => 'Å';   // you need to confirm this isn't already in use*
    public bool ShowInNotifier => false;
    public bool CanBePermissionAssigned => true;
    public string Icon => "icon-axis-rotation-2";
    public string Alias => "customDashboardAccess";
    public string Category => "customDashboardAdmin";
}