Add support for granular permissions in operation

[salmart-dev]

Description

Adds partial* support for granular permissions in Operation keeping the current behaviour intact.

* refers to the fact that additional work is required to support this in the UI. The current use-case is for WFE Runtime Operations, which are not stored in the DB and not shown in the UI.

Implementation details

Currently the operation field of the operation is always set to deny. This PR adds a json object of the shape { "permissions": int } to allow the definition of a custom set of permissions for the operation.

The StorageWrapper then checks against those permissions to see if the action is to be denied or not and returns the masked permissions when appropriate.

Note: AI has been used to review the code and concept and to fix some issues with the original code.

TODO

• Add integration tests

[nickvergessen]

This app has a quite good set of behat integration tests.
Would be good if they are extended to cover this.

---

Is this only going to be used in a scripted way, or is it planned to add a frontend (preferable not 🙈)?

[salmart-dev]

This app has a quite good set of behat integration tests. Would be good if they are extended to cover this.

Is this only going to be used in a scripted way, or is it planned to add a frontend (preferable not 🙈)?

So far no plans to add a frontend, but how comes would you prefer not to?

[nickvergessen]

So far no plans to add a frontend, but how comes would you prefer not to?

Because it adds javascript/npm and the full trail as a dependency 🙈

[salmart-dev]

This app has a quite good set of behat integration tests.
Would be good if they are extended to cover this.

Good point, I'll look into this!

[nickvergessen]

Otherwise looks good

[salmart-dev]

@nickvergessen added some tests and documented (with tests) the current response for permissions as I find it very confusing 😆

The way files are visible although blocked is so funky 😓 they are visible because we don't filter using the READ permission when listing directories and then the permission appears as R for those files because in server's DavUtil we have a condition that checks if the SHARE permission is there then add R to the permissions string, which is how we end up with R permission but blocked file 🤯

I will push the cs fixes when squashing, to avoid triggering CI one more time 👍