Remote Interaction (ie. `dolt_clone()`, `dolt_fetch()`, `dolt_push()`) Stored Procedure Permissions
- Dominant language
- Go
- Stars
- 24.4k
- Forks
- 873
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 120
Description
Currently any user on the server can call any stored procedure. This includes `dolt_push`, and could result in escalation of privileges in some cases.
This is somewhat similar to branch permissions, but in the cases of pushing and pulling, users use global credentials set up by the administrator. It may be the case that each user needs their own credentials so that the server you are pushing to has a strong authentication.
TODO: Determine the scope of permissions concerns on these methods, and develop/implement a permissions model for them.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the remote stored-procedure entry points named in the issue: dolt_clone(), dolt_fetch(), and dolt_push(). Determine the scope of their permission concerns, including the global credentials used for pushing and pulling; done means a permissions model for these methods is developed and implemented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- sql
- Domain
- databases, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100