DependencyTrack / DependencyTrack/dependency-track

Create new access right VIEW_PROJECT to prevent dashboard access

Open
#3,465 1 comment 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

As mentioned in the issue #2323, the portfolio project metrics are not filtered according to portfolio access control (beta feature). Consequently, users with limited portfolio access control can view aggregated metrics for all the projects when granted with VIEW_PORTFOLIO access right.

Because the [PR](https://github.com/DependencyTrack/dependency-track/pull/2326#issue-1509523345) that fixes the filtering according to portfolio access control is still pending for approval, I would like to propose a workaround that might possibly get faster acceptance.

### Proposed Behavior

I propose to introduce a new access right named VIEW_PROJECTS, which would specifically grant access only to the projects menu entry. With this new additional permission, it will no longer be required to provide the VIEW_PORTFOLIO access right to users that have a limited portfolio access hence preventing those to view the dashboard section.

Please kindly provide comments or other alternative suggestions. This feature holds significant importance for us, and I may have some availability in the coming days to work on its implementation.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.