How to remove permissions in child objects from parent?
- Dominant language
- Python
- Stars
- 4.4k
- Forks
- 437
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 15
Description
We've got two things:
- Inheritance
- Auto write permission on update.
If I have the write permission on a bucket and that I update a records or a collection, my userid will be added to the write ACL on each record or collection I have updated.
If someone wants to remove my permission from this bucket, she will have to also update all the records I have been editing in between.
I propose that we add the write permission to an object only if after applying permission update on the object, we don't have the write permission anymore.
Which means:
- We removed the permission we had and it is not a good idea
- We only add the "*:create" permission and we need the write permission on this object
- If we still have the write permission on the object, it means we inherited from the object permission and we are all set already (so we do not need to add the userid to the write ACL)
Contributor guide
Research direction
Start by tracing permission inheritance and the automatic write-ACL update behavior described in the issue. Determine how removing a parent permission affects child objects, then verify that updates add a user only when the resulting object permissions no longer provide the required access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authorization
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100