Update WorkflowAPI to accept a list of permissions with a content submission

[wezell]

If a user wants to post a new piece of content and permission it individually at the time of saving, they should be able to pass a Map<String,List> of permissions and the roles that have them, e.g.

"individualPermissions":{
   "READ":["34324324-2354325-324234","234324-23423-32432-324432","234234234-234234-324"],
   "ADD_TO":["34324324-2354325-324234","234324-23423-32432-324432","234234234-234234-324"],
   "WRITE":["34324324-2354325-324234","234324-23423-32432-324432","234234234-234234-324"],
   "PUBLISH":["34324324-2354325-324234","234324-23423-32432-324432","234234234-234234-324"],
   "EDIT_PERMISSIONS":["34324324-2354325-324234","234324-23423-32432-324432","234234234-234234-324"]
}

[nollymar]

These PRs contain part of the changes: #22717 and #22424

[nollymar]

Internal QA: Needs work.

I found some details using System Workflow and this endpoint PUT localhost:8080/api/v1/workflow/actions/fire:

1. The endpoint only works with Publish action.
   This works:

{
    "actionName": "publish",
    "comments": "publish content",
    "contentlet": {
      "contentType":"MyType",
      "title": "Content 1",
      "identifier": "db982967e39ffaf6262f00be12679728"
    },
    "individualPermissions": {
          "EDIT_PERMISSIONS":["02ae46fa-cb67-4ed8-82d5-f1f9a5e1d744"],
          "CAN_ADD_CHILDREN": ["e37accbd-6a67-4ff4-adfe-cff423030a0b"],
          "READ": ["9ad24203-ae6a-4e5e-aa10-a8c38fd11f17"],
          "WRITE":["b9236d3a-41d4-4efd-a695-cb0f758cbf86"],
          "PUBLISH":["d8beb217-1889-40dd-99ad-fbd3cab7c426", "d3e78673-044a-4e1e-a38a-56f48cc6d5a5", "9ad24203-ae6a-4e5e-aa10-a8c38fd11f17"]
    }
}  

but the Save action doesn't:

{
    "actionName": "save",
    "comments": "save content",
    "contentlet": {
      "contentType":"MyType",
      "title": "Content 1",
      "identifier": "db982967e39ffaf6262f00be12679728"
    },
    "individualPermissions": {
          "EDIT_PERMISSIONS":["02ae46fa-cb67-4ed8-82d5-f1f9a5e1d744"],
          "CAN_ADD_CHILDREN": ["e37accbd-6a67-4ff4-adfe-cff423030a0b"],
          "READ": ["9ad24203-ae6a-4e5e-aa10-a8c38fd11f17"],
          "WRITE":["b9236d3a-41d4-4efd-a695-cb0f758cbf86"],
          "PUBLISH":["d8beb217-1889-40dd-99ad-fbd3cab7c426", "d3e78673-044a-4e1e-a38a-56f48cc6d5a5", "9ad24203-ae6a-4e5e-aa10-a8c38fd11f17"]
    }
} 

2. If I type an invalid roleId, the response is 200 (OK) and all the permissions added after the invalid one are ignored:

{
    "actionName": "publish",
    "comments": "publish content",
    "contentlet": {
      "contentType":"MyType",
      "title": "Content 1",
      "identifier": "db982967e39ffaf6262f00be12679728"
    },
    "individualPermissions": {
          "EDIT_PERMISSIONS":["02ae46fa-cb67-4ed8-82d5-f1f9a5e1d744"],
          "CAN_ADD_CHILDREN": ["e37accbd-6a67-4ff4-adfe-cff423030a0b"],
          "READ": ["dfgdgdfgdfg"], --> Invalid one
          "WRITE":["b9236d3a-41d4-4efd-a695-cb0f758cbf86"], --> Ignored
          "PUBLISH":["d8beb217-1889-40dd-99ad-fbd3cab7c426", "d3e78673-044a-4e1e-a38a-56f48cc6d5a5", "9ad24203-ae6a-4e5e-aa10-a8c38fd11f17"] --> Ignored
    }
}  

Question: What CAN_ADD_CHILDREN is supposed to do? I only noticed that it locks the role. Is it expected?

Room for improvement:

• If I send the individualPermissions field when updating a piece of content, I have to specify all the permissions for each role, otherwise, they are wiped out. For example:
  If I run:

{
    "actionName": "publish",
    "comments": "publish content",
    "contentlet": {
      "contentType":"MyType",
      "title": "Content 1",
      "identifier": "db982967e39ffaf6262f00be12679728"
    },
    "individualPermissions": {
          "EDIT_PERMISSIONS":["02ae46fa-cb67-4ed8-82d5-f1f9a5e1d744"],
          "CAN_ADD_CHILDREN": ["e37accbd-6a67-4ff4-adfe-cff423030a0b"],
          "WRITE":["b9236d3a-41d4-4efd-a695-cb0f758cbf86"], 
          "PUBLISH":["d8beb217-1889-40dd-99ad-fbd3cab7c426", "d3e78673-044a-4e1e-a38a-56f48cc6d5a5", "9ad24203-ae6a-4e5e-aa10-a8c38fd11f17"] 
    }
}  

and then:

{
    "actionName": "publish",
    "comments": "publish content",
    "contentlet": {
      "contentType":"MyType",
      "title": "Content 1",
      "identifier": "db982967e39ffaf6262f00be12679728"
    },
    "individualPermissions": {
          "EDIT_PERMISSIONS":["02ae46fa-cb67-4ed8-82d5-f1f9a5e1d744"],
          "CAN_ADD_CHILDREN": ["e37accbd-6a67-4ff4-adfe-cff423030a0b"],
          "PUBLISH":["d8beb217-1889-40dd-99ad-fbd3cab7c426", "d3e78673-044a-4e1e-a38a-56f48cc6d5a5", "9ad24203-ae6a-4e5e-aa10-a8c38fd11f17"] 
    }
}  

The WRITE permission is wiped out. I think the WRITE should be ignored unless I set []

• Not part of the scope, but we should be able to send the userid or the role name because there is no way to get the roleId from UI (I had to query the database)

[jdotcms]

Good QA

Just to mention: the save works, but the save draft do not.
As an improvement the save draft actionlet should consider the permissions as the save actionlet does

[bryanboza]

Fixed, some things failing here, but the pending work was moved to new card #22993