| name | harden-permissions |
| description | Uses Playwright to set permissions on unsecured Shesha API endpoints via the permissioned-objects admin UI. Restricts write operations to app:Configurator. Use when the user wants to harden, secure, or lock down API endpoints, fix permissioned-objects, restrict access to admin-only services, or add authorization to unprotected app services in a Shesha application. |
Harden Permissions
Automates permission changes on the Shesha permissioned-objects page (/dynamic/Shesha/permissioned-objects) using Playwright.
Prerequisites
Playwright must be installed globally (npm i -g @playwright/test). Verify with npx playwright --version.
Procedure
-
Ask the user for:
- Base URL (e.g.
http://localhost:3000)
- Admin credentials (username and password)
-
Run the script in dry-run mode first to preview changes:
node <skill-dir>/scripts/harden-permissions.js <baseUrl> <username> '<password>' --dry-run
-
After user confirms, run without --dry-run:
node <skill-dir>/scripts/harden-permissions.js <baseUrl> <username> '<password>'
-
Report the results. If any endpoints fail, note them for manual follow-up.
What the script changes
Class-level Requires permissions + app:Configurator
All endpoints in these services become admin-only:
- ProcessMonitor
- DeviceForceUpdate
- DeviceRegistration
- SmsGateways
Class-level Any authenticated + method-level app:Configurator on write ops
Read endpoints stay open to logged-in users. Write operations require app:Configurator:
| Service | Restricted methods |
|---|
| Area | Create, Delete, Update, MoveArea |
| ConfigurableComponent | Create, Delete, Update, UpdateSettings |
| EntityConfig | Create, Delete, Update, RemoveConfigurationsOfMissingClasses |
| EntityProperty | Create, Delete, Update |
| ReferenceList | Create, Delete, Update, ClearCacheFull |
| ShaRole | Create, Delete, Update |
| Notification | Publish |
| NotificationMessage | Create, Delete, Update |
| QuestionAnswers | Delete |
Specific methods only (no class-level change)
| Service | Methods | Access |
|---|
| Session | ClearPermissionsCache | app:Configurator |
| UserManagement | Create, CompleteRegistration | app:Configurator |
Customization
Edit the CHANGES array in scripts/harden-permissions.js to add/remove services or endpoints.
What is NOT changed
- Services already marked
(permissioned) in the UI
[AbpAllowAnonymous] endpoints (password reset, login)- Read-only endpoints needed by forms runtime (Metadata, ReferenceList.GetItems, etc.)
- The
Aaaaaaa test service (flag for removal instead)
