feat: control if an application is allowed to contribute activities

closes #122

projects/app/workbench-application-platform/dev-tools-app/src/app/dev-tools/application-view/application-view.component.html

@@ -13,6 +13,11 @@
     <a class="manifest-url" [href]="manifest.manifestUrl" target="_blank">{{manifest.manifestUrl}}</a>
   </ng-container>
 
+  <ng-container *ngIf="manifest?.restrictions">
+    <label class="restrictions">Restrictions:</label>
+    <sci-property [properties]="manifest.restrictions" class="restrictions"></sci-property>
+  </ng-container>
+
   <span *ngIf="manifest?.scopeCheckDisabled" class="scope-check-disabled"
         [title]="'Scope check is disabled for this application.\nThis application can use private capabilities of other applications.'">
     SCOPE CHECK DISABLED

projects/app/workbench-application-platform/dev-tools-app/src/app/dev-tools/application-view/application-view.component.scss

@@ -21,47 +21,47 @@
 
     > label.app-name {
       grid-column: 1/2;
-      grid-row: 1/2;
     }
 
     > span.app-name {
       grid-column: 2/3;
-      grid-row: 1/2;
     }
 
     > label.app-symbolic-name {
       grid-column: 1/2;
-      grid-row: 2/3;
     }
 
     > span.app-symbolic-name {
       grid-column: 2/3;
-      grid-row: 2/3;
     }
 
     > label.app-url {
       grid-column: 1/2;
-      grid-row: 3/4;
     }
 
     > a.app-url {
       grid-column: 2/3;
-      grid-row: 3/4;
     }
 
     > label.manifest-url {
       grid-column: 1/2;
-      grid-row: 4/5;
     }
 
     > a.manifest-url {
       grid-column: 2/3;
-      grid-row: 4/5;
+    }
+
+    > label.restrictions {
+      grid-column: 1/2;
+    }
+
+    > sci-property.restrictions {
+      grid-column: 2/3;
     }
 
     > span.scope-check-disabled {
       grid-column: 3/4;
-      grid-row: 1/5;
+      grid-row: 1/6;
       align-self: start;
       justify-self: end;
       font-weight: bold;

projects/scion/workbench-application-platform.api/src/lib/core.model.ts

@@ -85,6 +85,17 @@ export interface Application {
    * By default, scope check is enabled, and should only be enabled for system applications like `DevTools`.
    */
   scopeCheckDisabled: boolean;
+  /**
+   * Defines restrictions for this application, e.g. to not contribute activities.
+   *
+   * By default, the app has no restrictions.
+   */
+  restrictions?: {
+    /**
+     * Controls if this application is allowed to contribute activities.
+     */
+    activityContributionAllowed: boolean;
+  };
 }
 
 /**

projects/scion/workbench-application-platform.api/src/lib/manifest-registry.model.ts

@@ -124,4 +124,8 @@ export interface Manifest {
    * Indicates whether or not capability scope check is disabled for this application.
    */
   scopeCheckDisabled: boolean;
+  /**
+   * Defines restrictions for this application.
+   */
+  restrictions: any;
 }

projects/scion/workbench-application-platform/src/lib/core/application-registry.service.ts

@@ -12,7 +12,7 @@ import { Injectable } from '@angular/core';
 import { ApplicationConfig, ApplicationManifest, HOST_APPLICATION_SYMBOLIC_NAME } from './metadata';
 import { Defined } from './defined.util';
 import { ManifestRegistry } from './manifest-registry.service';
-import { Application } from '@scion/workbench-application-platform.api';
+import { Application, Capability, PlatformCapabilityTypes } from '@scion/workbench-application-platform.api';
 import { Url } from './url.util';
 
 /**
@@ -52,20 +52,43 @@ export class ApplicationRegistry {
       throw Error(`[ApplicationRegistrationError] Symbolic name must be unique [symbolicName='${applicationConfig.symbolicName}'].`);
     }
 
-    const scopeCheckDisabled = applicationConfig.scopeCheckDisabled || false;
+    const scopeCheckDisabled = Defined.orElse(applicationConfig.scopeCheckDisabled, false);
+
     this._applications.set(applicationConfig.symbolicName, {
       symbolicName: applicationConfig.symbolicName,
       name: manifest.name,
       baseUrl: this.computeBaseUrl(applicationConfig, manifest),
       manifestUrl: new URL(applicationConfig.manifestUrl, Url.isAbsoluteUrl(applicationConfig.manifestUrl) ? applicationConfig.manifestUrl : window.origin).toString(),
       scopeCheckDisabled: scopeCheckDisabled,
+      restrictions: applicationConfig.restrictions,
     });
 
-    this._manifestRegistry.registerCapability(applicationConfig.symbolicName, manifest.capabilities);
+    this._manifestRegistry.registerCapability(applicationConfig.symbolicName, this.filterCapabilities(manifest.capabilities, applicationConfig));
     this._manifestRegistry.registerIntents(applicationConfig.symbolicName, manifest.intents);
     scopeCheckDisabled && this._manifestRegistry.disableScopeChecks(applicationConfig.symbolicName);
   }
 
+  /**
+   * Filters capabilities which given application is not allowed to provide.
+   */
+  private filterCapabilities(capabilities: Capability[], applicationConfig: ApplicationConfig): Capability[] {
+    const restrictions = applicationConfig.restrictions;
+    const activityContributionAllowed = Defined.orElse(restrictions && restrictions.activityContributionAllowed, true);
+
+    if (!activityContributionAllowed) {
+      return capabilities
+        .filter(capability => capability.type !== PlatformCapabilityTypes.Activity)
+        .map(capability => {
+          if (capability.type === PlatformCapabilityTypes.View) {
+            return ({...capability, properties: {...capability.properties, activityItem: null}});
+          }
+          return capability;
+        });
+    }
+
+    return capabilities;
+  }
+
   public getApplication(symbolicName: string): Application {
     return this._applications.get(symbolicName);
   }

projects/scion/workbench-application-platform/src/lib/core/metadata.ts

@@ -51,6 +51,17 @@ export interface ApplicationConfig {
    * By default, scope check is enabled.
    */
   scopeCheckDisabled?: boolean;
+  /**
+   * Defines restrictions for this application, e.g. to not contribute activities.
+   *
+   * By default, the app has no restrictions.
+   */
+  restrictions?: {
+    /**
+     * Controls if this application is allowed to contribute activities.
+     */
+    activityContributionAllowed: boolean;
+  };
 }
 
 /**

projects/scion/workbench-application-platform/src/lib/manifest-capability/manifest-registry-intent-handler.service.ts

@@ -150,6 +150,7 @@ export class ManifestRegistryIntentHandler implements IntentHandler {
       baseUrl: application.baseUrl,
       manifestUrl: application.manifestUrl,
       scopeCheckDisabled: application.scopeCheckDisabled,
+      restrictions: application.restrictions,
       intents: this._manifestRegistry.getIntentsByApplication(application.symbolicName),
       capabilities: this._manifestRegistry.getCapabilitiesByApplication(application.symbolicName)
         .filter(capability => !capability.metadata.proxy),

resources/site/how-to/workbench-application-platform/how-to-register-applications.md

@@ -14,6 +14,7 @@ Following properties are supported:
 |manifestUrl|string|✓|URL to the application manifest.|
 |exclude|boolean||Excludes the application from registration, e.g. to not register it in a specific environment.|
 |scopeCheckDisabled|boolean||Sets whether or not capability scope check is disabled for this application.<p>With scope check disabled (discouraged), the application can invoke private capabilities of other applications.<p>By default, scope check is enabled.|
+|restrictions|{activityContributionAllowed: boolean}||Defines restrictions for this application, e.g. to not contribute activities.<p>By default, the app has no restrictions.|
 
 ### Static application registration