access control & roles & uuid's

Justin Harris jharris at redhat.com
Fri Mar 19 15:57:05 UTC 2010


----- "Dmitri Dolguikh" <dmitri at redhat.com> wrote:

> On 10-03-19 11:48 AM, Justin Harris wrote:
> > I still feel funny about a given resource url resulting in different
> 
> > results
> > based on who is asking.  My inital thought on this was to have a
> similar setup
> > to what you proposed for the curators, but on the resources.  The
> main difference
> > being that instead of applying filters to a query, it simply allows
> access or 403s.
> >    
> hmm. I don't think I follow you. Let's consider
> 
> GET /consumers
> 
> And let's assume that the caller has 'owner' (or owner-admin in
> bryan's 
> taxonomy of roles)  role. We don't have owner uuid in the url, but the
> 
> request is valid. We can't return a 403; instead we should return all
> 
> consumers in the owner's organization.
> 
> Unless we create a management-client-specific methods (for the example
> 
> above: GET /owners/{owner_uuid}/consumers) I don't see any other way 
> around it.\

Yeah so this actually goes back to the collections thing.  I think that for REST this is interpreted as "all consumers in the system", which
IMO should only be available to the super-user (or whatever we call it) role.  The way to get a collection of consumers under an owner is, like
you said:  GET /owners/4/consumers - these are the consumers under this owner, and I think that the URL conveys that.

 - Justin


> 
> -d
> _______________________________________________
> candlepin mailing list
> candlepin at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/candlepin



More information about the candlepin mailing list