MIT-LCP / MIT-LCP/physionet-build

Move events access control into authorization module

Open
#2,016 0 comments 0 reactions 1 assignee View on GitHub

@superryeti is already working on this.

Since May 27, 2023.

Dominant language
JavaScript
Stars
90
Forks
33
Avg merge
1d 7h
Merged PRs (30d)
31

Description

In #1961 @amitupreti refactored the access checks into a separate module in the project app, so that all project authorization is done in one place, which has made project access in the code a lot easier to reason about. There are effectively two functions in the authorization module:

  • get_accessible_projects(user) - list out all projects a user can access
  • can_access_project(user, project) - can the user access the specified project?

(Side note: in my opinion, the reason to have the latter function with separate functionality is it is a hot path, and it might be worth optimization. Otherwise, it is trivially derived from get_accessible_projects(user).filter(project=project)).

Currently the events/models.py app skip the authorization module entirely:

https://github.com/MIT-LCP/physionet-build/blob/851735ff071b7d356e5b1c65061c02cae00be01a/physionet-django/events/models.py#L225-L241

This code should be moved into the authorization module. To keep it simple, creating a new has_event_access(user, project) function to the authorization module makes sense. Removing redundancy between has_event_access and has_access can be worked out in the future, and similarly improving the mechanism through which datasets are provisioned via events can equally be improved.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.