oxidecomputer / oxidecomputer/omicron
[nexus] Merge `SiloUserSessionList` and `ConsoleSessionList`
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 572
- Forks
- 97
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 96
Description
I added a SiloUserSessionList authz resource in #8479 in order to power the authz check on deleting all of a given user's sessions. Then I noticed we already have a ConsoleSessionList authz resource that we use to give the external authenticator user permission to create sessions on behalf of a user. I don't think we need to have both of these. Right now they're different in that the one I added references a particular user while the existing one is a global singleton, but there's no real need for the latter to be a singleton. It can just be absorbed into mine.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in nexus/auth/src/authz/api_resources.rs at the linked lines and compare the SiloUserSessionList and ConsoleSessionList definitions. Search for references to both resources, then consolidate them while preserving the authorization uses described in the issue. Done means one resource supports both deleting a user's sessions and creating sessions on that user's behalf.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- authorization, backend
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100