Kinto does now show permissions if you have `write` access on the parent object
Open
bug
scope: permissions
stale
- Dominant language
- Python
- Stars
- 4.4k
- Forks
- 437
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 15
Description
Kinto currently shows permissions for an object only if you have write permissions on the object. This however does not work as expected if the write permission is granted on a parent object. Although the user is able to modify the permissions, the output from a get request does not reflect the actual permissions.
Contributor guide
Research direction
Start by reproducing a GET request for an object whose write permission is inherited from a parent object, then trace the permission visibility behavior involved in that request. Done means the response reflects the object's actual permissions when write access comes from the parent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authorization
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100