Assigning permissions for custom entities

[TomasEvansCode]

Hi, I almost understand how permissions work in Oqtane, although am still a bit unclear on the scope of permissions in the module permission grid.

I have a custom entity ("Event") to which I will secure API access using the authorise attribute:
[Authorize(Policy = "Event:Write:Admin")]
This entity is keyed to the site so data would be shared across all Event module instances.
I am considering having multiple instances of this module each with different permissions granted.

My Event module permission grid:

From what I understand, each module "instance" has its own permission list.
I am struggling to understand the scope of these permissions since they are defined per module instance.

Do these permissions have a global effect or are they only in effect for the particular module?
Are the permissions only active while the module is being used?
If I had multiple Event edit modules with different permissions, would the permissions conflict?

Any guidance or tips would be much appreciated.

[TomasEvansCode]

I've made some progress in my understanding. In case it helps anyone, here is my current model:
(Please correct me if anything looks wrong)

• There is no hard relationship between modules and permissions (As in no foreign keys or standard table relationships). A permission can only be associated with a module instance via Permission.EntityName and Permission.EntityId using the same mechanism that it would use relate to any other entity.
• Aside from Edit and View, Permissions in the permission grid are not unique to the module instance. Editing the permissions grid simply results in them being applied to the Permissions table, which is keyed to a Site.
• The default "View Module" and "Edit Module" permissions have the unique behaviour of being assigned the EntityId to the currently edited module. This means they ARE unique to the current module instance. Other permissions have EntityId of -1 by default, meaning the permission applies to all entities of the permission's EntityName.

So in summary, permissions assigned to roles in the permission grid are site-wide by default and shared across all module instances, with the exception of "View Module" and "Edit Module", which are only associated with the current module instance because EntityId points to it.

[sbwalker]

@TomasEvansCode this is a very good description of how permissions function in Oqtane. Note that by default the framework utilizes View/Edit permissions for Modules, Pages, Folders, etc... and the concept of API permissions (site level) are only implemented in custom modules which need this additional functionality. More background on permissions is available here: https://www.oqtane.org/blog/!/55/permission-enhancements

[TomasEvansCode]

Also I should mention I am using Oqtane 5.2.4, in case things have changed since.