Access Control for Extensions

[tanaka-tri]

In reference to this GitHub issue(#400), is there a way to enable access control for extensions so that they are visible only to specific user groups rather than being public or accessible to everyone?

If this feature is not currently available, could it be considered for addition to the project roadmap?

[fsch-ppi]

What I did is disable the creation of extensions for all non-admin users. My company is in europe so GDPR applies to us, making the extensions a "risky" feature.

Idea is for now, that only admins can see them and that if we have something sensible, that does not violate GDPR - for example searching our own jira - we will create user groups and publish the extensions to certian users (done by an admin)

[tanaka-tri]

@FlorianSchloesser
Thank you for your response.

Your idea sufficiently meets what we want to achieve. Could you please provide the steps to:
create user groups and publish the extensions to certian users (done by an admin)

Best regards,

[GTechnologiesHub]

What I did is disable the creation of extensions for all non-admin users. My company is in europe so GDPR applies to us, making the extensions a "risky" feature.

Idea is for now, that only admins can see them and that if we have something sensible, that does not violate GDPR - for example searching our own jira - we will create user groups and publish the extensions to certian users (done by an admin)

@FlorianSchloesser how did you achieve this?

[fsch-ppi]

@tanaka-tri
@GTechnologiesHub
I have no user groups as of now, only took out the Icon for the extensions, and added the following lines to the files.
Please forgive me not sharing full code files - since this does not comply with my work regulations.

1. I have added the "/extensions" list in my filter for admins in the middleware.ts
   

2. I have added a check in the extension-service.ts so users cannot create extensions:
   

3. I have added an admin check in the main-menu.tsx file:
   

Once I really do create user groups I will update you.

I think the approach here is using Microsoft Entra ID and create user groups via that. You could then store that in the session object and expand the Prompt, Persona and Extension entries in the DB, by booleans of groups who should be able to see them.

This can be made more sophisticated of course - but that would be my general approach.