[Issue] Bulk ACL management for AsynchronousOperations Admin UI

[m2-assistant]

This issue is automatically created based on existing pull request: #27580: Bulk ACL management for AsynchronousOperations Admin UI

---

Description (*)

After Migrating of Asynchronous Operations from Magento Commerce to Magento Open Source, looks like part of functionality was extended.

In details:
In magento_bulk table was added user_type, which defines type of the user who created Bulk Operation.

Possible types are:

• Admin
• Integration
• Guest
• Customer

In current implementation all Admin UI components have no idea about user type:

https://github.com/magento/magento2/blob/2.4-develop/app/code/Magento/AsynchronousOperations/view/adminhtml/ui_component/bulk_listing.xml - in default Grid there are NO DataSource is defined, so Admin see the whole operations, but at the same time, he cannot see Details of those operations:

https://github.com/magento/magento2/blob/2.4-develop/app/code/Magento/AsynchronousOperations/Controller/Adminhtml/Bulk/Details.php#L52

But at you can see from implementation,
https://github.com/magento/magento2/blob/2.4-develop/app/code/Magento/AsynchronousOperations/Model/AccessValidator.php#L58

that permissions are checked based on UserID and fully ignoring UserType. Which means, that Admin has access to All transactions or all user types with the same ID.

Fixed Issues (if relevant)

Current implementation will add:

• New ACL roles for give possibilities for Admin define permissions for Admin/Integration user to have access only to specific user types operations.
• With restricted user role, Admin will be able to see only operations that are assigned to him, View detailes or Restart them
• Also Admin notifications will be restricted only to allowed.

Questions or comments

Auto tests still in process, but main implementation can be already reviewed.

Contribution checklist (*)

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All new or changed code is covered with unit/integration tests (if applicable)
• All automated tests passed successfully (all builds are green)