Kinto / Kinto/kinto

How to remove permissions in child objects from parent?

Open
#144 1 comment 0 reactions 0 assignees View on GitHub
question scope: permissions stale
Dominant language
Python
Stars
4.4k
Forks
437
Avg merge
1d 2h
Merged PRs (30d)
15

Description

We've got two things:
- Inheritance
- Auto write permission on update.

If I have the write permission on a bucket and that I update a records or a collection, my userid will be added to the write ACL on each record or collection I have updated.

If someone wants to remove my permission from this bucket, she will have to also update all the records I have been editing in between.

I propose that we add the write permission to an object only if after applying permission update on the object, we don't have the write permission anymore.

Which means:
- We removed the permission we had and it is not a good idea
- We only add the "*:create" permission and we need the write permission on this object
- If we still have the write permission on the object, it means we inherited from the object permission and we are all set already (so we do not need to add the userid to the write ACL)

Contributor guide

Open the contributing guide

Research direction

Start by tracing permission inheritance and the automatic write-ACL update behavior described in the issue. Determine how removing a parent permission affects child objects, then verify that updates add a user only when the resulting object permissions no longer provide the required access.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authorization
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.