access control & roles & uuid's
Justin Harris
jharris at redhat.com
Fri Mar 19 15:57:05 UTC 2010
----- "Dmitri Dolguikh" <dmitri at redhat.com> wrote:
> On 10-03-19 11:48 AM, Justin Harris wrote:
> > I still feel funny about a given resource url resulting in different
>
> > results
> > based on who is asking. My inital thought on this was to have a
> similar setup
> > to what you proposed for the curators, but on the resources. The
> main difference
> > being that instead of applying filters to a query, it simply allows
> access or 403s.
> >
> hmm. I don't think I follow you. Let's consider
>
> GET /consumers
>
> And let's assume that the caller has 'owner' (or owner-admin in
> bryan's
> taxonomy of roles) role. We don't have owner uuid in the url, but the
>
> request is valid. We can't return a 403; instead we should return all
>
> consumers in the owner's organization.
>
> Unless we create a management-client-specific methods (for the example
>
> above: GET /owners/{owner_uuid}/consumers) I don't see any other way
> around it.\
Yeah so this actually goes back to the collections thing. I think that for REST this is interpreted as "all consumers in the system", which
IMO should only be available to the super-user (or whatever we call it) role. The way to get a collection of consumers under an owner is, like
you said: GET /owners/4/consumers - these are the consumers under this owner, and I think that the URL conveys that.
- Justin
>
> -d
> _______________________________________________
> candlepin mailing list
> candlepin at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/candlepin
More information about the candlepin
mailing list