solid / solid/data-interoperability-panel
Consider giving grantee a read access to the Authorization
Nobody has claimed this yet.
- Dominant language
- Bikeshed
- Stars
- 58
- Forks
- 18
- PR merge metrics
- No merged PRs in 30d
Description
Currently, we assume that the grantee can only access the grant but not the authorization, this leads to re-stating the same information in the authorization and the grant. We should re-consider what exactly are we trying to prevent from being disclosed and document reasoning whichever way it lands.
Scopes
While grantees will not explicitly know if they were granted All or AllFromAgent scope in the authorization, they still should be able to make informed guess based on observed changes to auto-generated grants.
Granted / Denied
In #278 and #293, we have some ongoing work on denying and revoking access. I don't think there is any information in the authorization that would not be available in the grant. Still, we should double-check.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the authorization and grant behavior described in this issue, then review the denial and revocation work in #278 and #293. Compare what a grantee can infer from scopes and observed changes to auto-generated grants, and identify what information authorization access could disclose. Done means a documented decision and rationale on whether grantees should receive read access.
Written by the indexing model from the issue text.
Assessment
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100