Handle permission checks in the controllers
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 1.4k
- Forks
- 354
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 43
Description
Currently permission checks happen at the service classes which is kind of hard to maintain, especially when trying to reuse services outside of user calls e.g. within occ command that do not have a current user present.
Ideally the permission checks should rather happen at the controller level.
Enforcing through annotations like in talk seems like a nice approach https://github.com/nextcloud/spreed/blob/master/lib/Middleware/InjectionMiddleware.php
Additional caution required to avoid duplicate queries with the relational object structure we have.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the permission checks in the service classes and their controller callers. Read the referenced spreed lib/Middleware/InjectionMiddleware.php example, then define how controller-level checks can support occ commands without a current user and avoid duplicate queries in the relational object structure. Done means the design and affected entry points are agreed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authorization, backend
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100