guardian / guardian/facia-tool
Missing config collections causing permission edge case
- Dominant language
- TypeScript
- Stars
- 29
- Forks
- 7
- Avg merge
- 4d 13h
- Merged PRs (30d)
- 18
Description
## Problem
As noted in https://github.com/guardian/facia-tool/pull/2000.
If the config for collections is unavailable the Fronts tool is unable to determine which permissions are required to interact with it. Currently the tool assumes no permissions are required. In practice this should be unlikely but is a potentially dangerous assumption to make.
https://github.com/guardian/facia-tool/blob/93fd82d29f6ee9946b826867be1b952db286278e/app/permissions/CollectionPermissions.scala#L12-L17
We can check the warning logs to see how frequently this case occurs.
## Solution
Determine as sensible approach for handling a lack of config when determining required permissions for a collection:
- Should we assume all permissions are required?
- Should we simply reject the request with a 5XX error?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with app/permissions/CollectionPermissions.scala at lines 12-17 and inspect the warning logs to establish how often collection configuration is unavailable. Decide and document the safe behavior for missing configuration, then verify that permission checks no longer silently assume that no permissions are required.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- scala
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100