From 85c760477a49cb968f9707243c58e68e826cece9 Mon Sep 17 00:00:00 2001
From: David Stephan <david.stephan@exense.ch>
Date: Thu, 19 Mar 2026 17:07:15 +0100
Subject: [PATCH 1/2] SED-4536 Granular access control for resource types

---
 .../server/access/AuthorizationManager.java        | 14 ++++++++++++++
 .../server/access/NoAuthorizationManager.java      |  5 +++++
 2 files changed, 19 insertions(+)

diff --git a/step-framework-server/src/main/java/step/framework/server/access/AuthorizationManager.java b/step-framework-server/src/main/java/step/framework/server/access/AuthorizationManager.java
index 864ce1c..f372646 100644
--- a/step-framework-server/src/main/java/step/framework/server/access/AuthorizationManager.java
+++ b/step-framework-server/src/main/java/step/framework/server/access/AuthorizationManager.java
@@ -27,8 +27,22 @@ public interface AuthorizationManager<U extends AbstractUser, S extends Session<
 
     void setRoleResolver(RoleResolver roleResolver);
 
+    /**
+     * Check if the give right is granted for the provided context (Session)
+     * @param session the session to check against
+     * @param right the right to be validated
+     * @return true when the session is granted the provided right
+     */
     boolean checkRightInContext(S session, String right);
 
+    /**
+     * Check if the right is defined in the system. If it isn't the right is automatically granted, otherwise it falls back to the checkRightInContext
+     * @param session the session to check against
+     * @param right the right to be validated
+     * @return true when the session is granted the provided right
+     */
+    boolean checkRightInContextIfDefined(S session, String right);
+
     default boolean checkRightInContext(S session, String right, String usernameOnBehalfOf) {
         // onBehalfOf is not supported by default
         if (usernameOnBehalfOf == null || usernameOnBehalfOf.isEmpty()) {
diff --git a/step-framework-server/src/main/java/step/framework/server/access/NoAuthorizationManager.java b/step-framework-server/src/main/java/step/framework/server/access/NoAuthorizationManager.java
index 670c90e..79cde18 100644
--- a/step-framework-server/src/main/java/step/framework/server/access/NoAuthorizationManager.java
+++ b/step-framework-server/src/main/java/step/framework/server/access/NoAuthorizationManager.java
@@ -15,6 +15,11 @@ public boolean checkRightInContext(Session session, String right) {
         return true;
     }
 
+    @Override
+    public boolean checkRightInContextIfDefined(Session session, String right) {
+        return true;
+    }
+
     @Override
     public boolean checkRightInContext(Session session, String right, String usernameOnBehalfOf) {
         return true;

From af23507a3bc26087f42db2f3aa2e0d86221bb863 Mon Sep 17 00:00:00 2001
From: David Stephan <david.stephan@exense.ch>
Date: Fri, 20 Mar 2026 11:35:32 +0100
Subject: [PATCH 2/2] SED-4536 PR feedbacks

---
 .../step/framework/server/access/AuthorizationManager.java    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/step-framework-server/src/main/java/step/framework/server/access/AuthorizationManager.java b/step-framework-server/src/main/java/step/framework/server/access/AuthorizationManager.java
index f372646..030b41a 100644
--- a/step-framework-server/src/main/java/step/framework/server/access/AuthorizationManager.java
+++ b/step-framework-server/src/main/java/step/framework/server/access/AuthorizationManager.java
@@ -28,7 +28,7 @@ public interface AuthorizationManager<U extends AbstractUser, S extends Session<
     void setRoleResolver(RoleResolver roleResolver);
 
     /**
-     * Check if the give right is granted for the provided context (Session)
+     * Checks if the given right is granted for the provided context (Session)
      * @param session the session to check against
      * @param right the right to be validated
      * @return true when the session is granted the provided right
@@ -36,7 +36,7 @@ public interface AuthorizationManager<U extends AbstractUser, S extends Session<
     boolean checkRightInContext(S session, String right);
 
     /**
-     * Check if the right is defined in the system. If it isn't the right is automatically granted, otherwise it falls back to the checkRightInContext
+     * Checks if the right is defined in the system. If not, the right is automatically granted. Otherwise, it delegates to {@link #checkRightInContext(S, String)}.
      * @param session the session to check against
      * @param right the right to be validated
      * @return true when the session is granted the provided right