Routing doesn't follow RBAC setting

[softark]

You could control the visivility of "Routing" menu item by using a resource "Routing(Viewer task)", but the functionality could be still triggered by a right click on the map canvas.

I tried adding another resource "Routing(Plugin)" to control this, but it didn't work.

Or is there something I'm missing?

[manisandro]

It should be sufficient to create permissions for resources of type ViewerTask with name Routing. Then, the plugin configuration block should get filtered out from config.json [1]. You can check whether the <viewerurl>/config.json still contains any trace of the Routing plugin.

[1] https://github.com/qwc-services/qwc-map-viewer/blob/master/src/qwc2_viewer.py#L569

[softark]

I've checked <viewerurl>/config.json, and the plugin confiuration block still contains Routing plugin while the menu item of it is filtered out as expected.

I also tried adding a permission for the resource of type Plugin with the name of Routing, but it didn't work either.

[softark]

I guess the MapInfoTooltip plugin has something to do with it.
It looks like that the MapInfoTooltip plugin includes the Routing plugin into the viewer configuration bypassing or overriding the RBAC filter.

https://qwc-services.github.io/master/references/qwc2_plugins/#mapinfotooltip

[manisandro]

Are you using a current version of qwc2? (say 2025-lts?)

[softark]

Yes, I think so, according to my docker-compose.yml.

   qwc-map-viewer:
     # Stock qwc2 app
     image: sourcepole/qwc-map-viewer:latest-2025-lts
     # Or with own viewer build placed in volumes/qwc2
     # image: sourcepole/qwc-map-viewer-base:latest-2025-lts
     # Update config.json with:
     # curl -L -o volumes/config-in/config.json https://github.com/qgis/qwc2-demo-app/raw/master/static/config.json
     # and generate service configuration
     environment:
       <<: *qwc-service-variables
       SERVICE_MOUNTPOINT: '/'
     volumes:
       - ./pg_service.conf:/srv/pg_service.conf:ro
       - ./volumes/config:/srv/qwc_service/config:ro
       - ./volumes/qwc2/translations:/qwc2/translations:ro
       # When using qwc-map-viewer-demo:
       - ./volumes/qwc2/assets:/qwc2/assets:ro
       # When using own viewer build with qwc-map-viewer-base:
       #- ./volumes/qwc2:/qwc2:ro