Limit access to batches and tasks.
Open
- Dominant language
- JavaScript
- Stars
- 7
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
Currently, anyone who can submit an API call is authorized to access any record. However, in a real multi-tenant system, different users should be restricted to different records. For example:
- A _Composer_ should be able to access any `PreviewBatch` or `PreviewTask` which has a matching `consumerId`.
- A `Renderer` should be able to access any `PreviewTask` which has a matching `renderer` name.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the API entry points that access PreviewBatch and PreviewTask records. Define and verify access for Composers by consumerId and Renderers by renderer name; done means users cannot access records outside those rules.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- api, authorization, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100