influxdata / influxdata/influxdb
[bug or feature?] need to grant drop permission to non-admin user
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
### Bug report
currently using 0.13.0
There seems to be only 2 kinds of users: Admin and Non-admin. Admins are the only users who can DROP series or measurements, but cannot be restricted to certain databases. Non-admin users can be restricted to certain databases, but cannot drop anything. Seems like we need a middle ground here, like a "local-admin" who can be given administrative permissions for particular databases. Otherwise we must run many InfluxDB servers in order to manage permissions in this way.
**Steps to reproduce:**
Grant all permissions to a non-admin user, try to drop a series as that user
**Expected behavior:**
I want the user to be able to drop a series or measurement, but _only_ in their specified database.
**Actual behavior:**
The non-admin user can (at most) read and write data, but not drop anything.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the authorization paths for DROP operations on series and measurements, then examine how permissions are scoped to databases. The desired outcome is a permission model that lets a non-admin drop data only in specified databases while preserving existing admin and non-admin behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- authorization, databases
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100