Disable editing for non-editable skills for non-admin users
As the Skills in SUSI Skill CMS are publicly editable, any user has the access to edit them. Hence, there needed to be a better control over who can edit the Skills in CMS. We needed to implement a feature to allow Admins and higher user roles to change the status of a Skill to non-editable. The subsequent implementation on CMS would require disabling editing for non-editable Skills for non-admin users. This blog post explains how this feature has been implemented in SUSI.AI.
Adding a boolean parameter ‘editable’ to the Skill metadata
We needed to add a boolean parameter in the Skill metadata for each Skill. The boolean parameter is ‘editable’. If its value is true, then it implies that editing should be allowed for that Skill. If it is set to false, then the Skill should not be editable for non-admin users. By default, its value has been set to true for all Skills. This is implemented as follows in the SusiSkill.java file:
// in the getSkillMetadata() method skillMetadata.put("editable", getSkillEditStatus(model, group, language, skillname)); // declaration of the getSkillEditStatus() method public static boolean getSkillEditStatus(String model, String group, String language, String skillname) { // skill status JsonTray skillStatus = DAO.skillStatus; if (skillStatus.has(model)) { JSONObject modelName = skillStatus.getJSONObject(model); if (modelName.has(group)) { JSONObject groupName = modelName.getJSONObject(group); if (groupName.has(language)) { JSONObject languageName = groupName.getJSONObject(language); if (languageName.has(skillname)) { JSONObject skillName = languageName.getJSONObject(skillname); if (skillName.has("editable")) { return false; } } } } } return true; }
Allowing Admin and higher user roles to change edit status of any Skill
This is facilitated by the endpoint ‘/cms/changeSkillStatus.json’. Its minimum base user role is set to Admin so that only Admins and higher user roles are able to change status of any Skill. A sample API call to this endpoint to change the edit status of any Skill to ‘false’ is as follows:
http://127.0.0.1:4000/cms/changeSkillStatus.json?model=general&group=Knowledge&language=en&skill=aboutsusi&editable=false&access_token=zdasIagg71NF9S2Wu060ZxrRdHeFAx
If we want to change the edit status of any Skill to ‘false’, then we need to add the Skill to the ‘skillStatus.json’ file. For this, we need to traverse inside the JSONObject in the ‘skillStatus.json’ file. We need to traverse inside the model, group and language as specified in the query parameters. This is done as follows:
if(editable.equals("false")) { skill_status.put("editable", false); } JsonTray skillStatus = DAO.skillStatus; if (skillStatus.has(model_name)) { modelName = skillStatus.getJSONObject(model_name); if (modelName.has(group_name)) { groupName = modelName.getJSONObject(group_name); if (groupName.has(language_name)) { languageName = groupName.getJSONObject(language_name); if (languageName.has(skill_name)) { skillName = languageName.getJSONObject(skill_name); if(editable != null && editable.equals("false")) { skillName.put("editable", false); } else if(editable != null && editable.equals("true")) { skillName.remove("editable"); } skillStatus.commit(); result.put("accepted", true); result.put("message", "Skill status changed successfully."); return new ServiceResponse(result); } } } }
If we want to change the edit status of any Skill to ‘true’, then we need to remove the Skill from the ‘skillStatus.json’ file. We also need to remove all the empty JSONObjects inside the ‘skillStatus.json’ file, if they are created in the process of removing Skills from it. This is done as follows:
if (skillStatus.has(model_name)) { modelName = skillStatus.getJSONObject(model_name); if (modelName.has(group_name)) { groupName = modelName.getJSONObject(group_name); if (groupName.has(language_name)) { languageName = groupName.getJSONObject(language_name); if (languageName.has(skill_name)) { skillName = languageName.getJSONObject(skill_name); if(editable != null && editable.equals("true")) { skillName.remove("editable"); } if(skillName.length() == 0) { languageName.remove(skill_name); if(languageName.length() == 0) { groupName.remove(language_name); if(groupName.length() == 0) { modelName.remove(group_name); if(modelName.length() == 0) { skillStatus.remove(model_name); } } } } skillStatus.commit(); } } } }
Disabling editing for non-editable Skills for non-admin users on Skill CMS
For the Skills whose edit status has been set to ‘false’ by the Admins, we need to allow the non-admin users to only be able to view the code of the Skill, and not permit them to change the code and save the changes to the Skill. We need to display a message to the users about the possible reasons. All the code for displaying the message is put in an if() condition as follows:
if ( cookies.get('loggedIn') && !this.state.editable && !this.state.showAdmin )
This is how the Skill edit page for a non-editable Skill would look like for a non-admin user:
For an Admin user, this would look exactly same like an editable Skill page. Admin user would be able to edit and make changes to the Skill code and save the changes.
This is how editing of non-editable Skills have been disabled for non-admin users.
You must be logged in to post a comment.