Add access control

[djhi]

Problems

1. Using authProvider.getPermissions() leads developers to put the access control logic in the components. It's hard to keep track of the rules.
2. The authentication checks are optimistic, so react-admin sometimes renders restricted content for a brief moment even though the user is anonymous

Solution

1. Invert the logic: put the access control logic in the authProvider, and have the components rely on it. Add access control to the main pages, disabled by default.
2. Make authentication check pessimistic

To do

• Add a new optional canAccess method to the authProvider
• Add a useCanAccess hook
• Add a <CanAccess> component
• Add a useCanAccessResources hook
• Add a useCanAccessCallback hook
• Make auth check in page controllers blocking
• Make auth check in <Authenticated> blocking
• Add access control check to page controllers (list, edit, create, show)
• Add access control check to action buttons (<ListButton>, <EditButton>, <CreateButton>, <ShowButton>, <DeleteButton>)
• Add access control to Datagrid rowClick (Add access control to <Datagrid rowClick> #10227)
• Add access control to ReferenceField link (Add access control to <Datagrid rowClick> #10227)
• Add access control to <Menu> (https://github.com/marmelab/react-admin/pull/10222/files#diff-7ea3c7cf3f7576675705b47a17ae782e9b3e752291035cc9b21b569ee1234c91)
• Add access control to the / route in the absence of a dashboard (Introduce <NavigateToFirstResource> #10255)
• Make authProvider.getPermissions() optional (Make authProvider.getPermissions optional #10257)
• Add a default AccessDenied view
• Add a default AuthenticationError view
• Add a ton of user stories
• Add a ton of tests
• Document the new features

How To Test

• Open the ra-core/Admin/Resource stories
• Open the ra-ui-materialui/layout/ResourceMenuItem stories

History

This is a big feature, so it was split into multiple PRs that got merged into this branch before merging it to next:

• Add access control to <DeleteButton> #10226
• Add access control to views and action buttons #10225
• Add access control to <Datagrid rowClick> #10227
• Pessimistic authentication checks #10238
• Add access control to controllers #10247
• [Doc] Rewrite access control documentation #10250
• Make Authenticated component secure by default #10251
• Introduce <NavigateToFirstResource> #10255
• Make authProvider.getPermissions optional #10257
• Access control: pessimistic rendering in CRUD views #10258

[fzaninotto]

Awesome! Can't wait to use that one.

I think the Permissions documentation needs some rewrite, though, to introduce this canAccess feature as an alternative to getPermissions. canAccess should be the recommended way. And we should rename the chapter to Access Control.

[djhi]

Awesome! Can't wait to use that one.

I think the Permissions documentation needs some rewrite, though, to introduce this canAccess feature as an alternative to getPermissions. canAccess should be the recommended way. And we should rename the chapter to Access Control.

I'd rather do that in a dedicated PR

[djhi]

Wrong fix IMO, we must introduce the same types as the other hooks for each state

[fzaninotto]

Nice to have?