From 32125041580fc954b47d7eb562800faf7cb19605 Mon Sep 17 00:00:00 2001 From: Max Novelli Date: Tue, 31 Oct 2023 13:09:10 +0100 Subject: [PATCH] reviewed authorization and fixed minor bugs --- Development/v4.x/backend/authorization.md | 1 + .../authorization/authorization_datasets.md | 47 +++++++++++-------- .../authorization_origdatablocks.md | 28 ++++++----- 3 files changed, 45 insertions(+), 31 deletions(-) diff --git a/Development/v4.x/backend/authorization.md b/Development/v4.x/backend/authorization.md index ff3b1dcb..d7095315 100644 --- a/Development/v4.x/backend/authorization.md +++ b/Development/v4.x/backend/authorization.md @@ -63,6 +63,7 @@ The permissions in the vanilla installation provides a set of user groups which ## Subsystems - [Datasets](authorization/authorization_datasets.md) - [OrigDatablocks](authorization/authorization_origdatablocks.md) +- [Jobs](authorization/authorization_jobs.md) - [Users](authorization/authorization_users.md) ___N.B.___: we know that many subsystems are still missing. We are working on reviewing the authorization model for each one of them and producing the relative documentation. We welcome any contribution. diff --git a/Development/v4.x/backend/authorization/authorization_datasets.md b/Development/v4.x/backend/authorization/authorization_datasets.md index 3e27f2b0..08786d97 100644 --- a/Development/v4.x/backend/authorization/authorization_datasets.md +++ b/Development/v4.x/backend/authorization/authorization_datasets.md @@ -23,9 +23,12 @@ This is the list of the permissions methods available for datasets and all their - DatasetCreateOwnerNoPid - DatasetCreateOwnerWithPid - DatasetCreateAny -- DatasetReadPublic -- DatasetReadAccess -- DatasetReadOwner +- DatasetReadManyPublic +- DatasetReadManyAccess +- DatasetReadManyOwner +- DatasetReadOnePublic +- DatasetReadOneAccess +- DatasetReadOneOwner - DatasetReadAny - DatasetUpdateOwner - DatasetUpdateAny @@ -60,7 +63,7 @@ This is the list of the permissions methods available for datasets and all their - DatasetDatablockUpdateAny - DatasetDatablockDeleteOwner - DatasetDatablockDeleteAny -- DatasetLogbookReadOwn +- DatasetLogbookReadOwner - DatasetLogbookReadAny ### Priority @@ -70,10 +73,14 @@ graph LR; DatasetCreate-->DatasetCreateOwnerNoPid; DatasetCreateOwnerNoPid-->DatasetCreateOwnerWithPid; DatasetCreateOwnerWithPid-->DatasetCreateAny; - DatasetRead-->DatasetReadPublic; - DatasetReadPublic-->DatasetReadAccess; - DatasetReadAccess-->DatasetReadOwner; - DatasetReadOwner-->DatasetReadAny; + DatasetRead-->DatasetReadManyPublic; + DatasetReadManyPublic-->DatasetReadManyAccess; + DatasetReadManyAccess-->DatasetReadManyOwner; + DatasetReadManyOwner-->DatasetReadAny; + DatasetRead-->DatasetReadOnePublic; + DatasetReadOnePublic-->DatasetReadOneAccess; + DatasetReadOneAccess-->DatasetReadOneOwner; + DatasetReadOneOwner-->DatasetReadAny; DatasetUpdate-->DatasetUpdateOwner; DatasetUpdateOwner-->DatasetUpdateAny; DatasetDelete-->DatasetDeleteOwner; @@ -86,12 +93,12 @@ graph LR; | POST | Datasets | _DatasetCreate_ | __no__ | __no__ | Owner, w/o PID
_DatasetCreateOwnerNoPid_ | Owner, w/ PID
_DatasetCreateOwnerWithPid_ | Any
_DatasetCreateAny_ | Any
_DatasetCreateAny_ | __no__ | | POST | Datasets/isValid | _DatasetCreate_ | __no__ | __no__ | Owner, w/o PID
_DatasetCreateOwnerNoPid_ | Owner, W/ PID
_DatasetCreateOwnerWithPid_ | Any
_DatasetCreateAny_ | Any
_DatasetCreateAny_ | __no__ | | GET | Datasets | _DatasetRead_ | Public
_DatasetReadPublic_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Any
_DatasetReadyAny_ | __no__ | -| GET | Datasets/fullquery | _DatasetRead_ | Public
_DatasetReadPublic_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Any
_DatasetReadAny_ | __no__ | -| GET | Datasets/fullfacet | _DatasetRead_ | Public
_DatasetReadPublic_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Any
_DatasetReadAny_ | __no__ | -| GET | Datasets/metadataKeys | _DatasetRead_ | Public
_DatasetReadPublic_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Any
_DatasetReadAny_ | __no__ | -| GET | Datasets/findOne | _DatasetRead_ | Public
_DatasetReadPublic_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Any
_DatasetReadAny_ | __no__ | -| GET | Datasets/count | _DatasetRead_ | Public
_DatasetReadPublic_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Any
_DatasetReadAny_ | __no__ | -| GET | Datasets/_pid_ | _DatasetRead_ | Public
_DatasetReadPublic_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Has Access
_DatasetReadAccess_ | Any
_DatasetReadAny_ | __no__ | +| GET | Datasets/fullquery | _DatasetRead_ | Public
_DatasetReadManyPublic_ | Has Access
_DatasetReadManyAccess_ | Has Access
_DatasetReadManyAccess_ | Has Access
_DatasetReadManyAccess_ | Has Access
_DatasetReadManyAccess_ | Any
_DatasetReadAny_ | __no__ | +| GET | Datasets/fullfacet | _DatasetRead_ | Public
_DatasetReadManyPublic_ | Has Access
_DatasetReadManyAccess_ | Has Access
_DatasetReadManyAccess_ | Has Access
_DatasetReadManyAccess_ | Has Access
_DatasetReadManyAccess_ | Any
_DatasetReadAny_ | __no__ | +| GET | Datasets/metadataKeys | _DatasetRead_ | Public
_DatasetReadManyPublic_ | Has Access
_DatasetReadManyAccess_ | Has Access
_DatasetReadManyAccess_ | Has Access
_DatasetReadManyAccess_ | Has Access
_DatasetReadManyAccess_ | Any
_DatasetReadAny_ | __no__ | +| GET | Datasets/count | _DatasetRead_ | Public
_DatasetReadManyPublic_ | Has Access
_DatasetReadManyAccess_ | Has Access
_DatasetReadManyAccess_ | Has Access
_DatasetReadManyAccess_ | Has Access
_DatasetReadManyAccess_ | Any
_DatasetReadAny_ | __no__ | +| GET | Datasets/findOne | _DatasetRead_ | Public
_DatasetReadOnePublic_ | Has Access
_DatasetReadOneAccess_ | Has Access
_DatasetReadOneAccess_ | Has Access
_DatasetReadOneAccess_ | Has Access
_DatasetReadOneAccess_ | Any
_DatasetReadAny_ | __no__ | +| GET | Datasets/_pid_ | _DatasetRead_ | Public
_DatasetReadOnePublic_ | Has Access
_DatasetReadOneAccess_ | Has Access
_DatasetReadOneAccess_ | Has Access
_DatasetReadOneAccess_ | Has Access
_DatasetReadOneAccess_ | Any
_DatasetReadAny_ | __no__ | | PATCH | Datasets/_pid_ | _DatasetUpdate_ | __no__ | __no__ | Owner
_DatasetUpdateOwner_ | Owner
_DatasetUpdateOwner_ | Owner
_DatasetUpdateOwner_ | Any
_DatasetUpdateAny_ | __no__ | | PUT | Datasets/_pid_ | _DatasetUpdate_ |__no__ | __no__ | Owner
_DatasetUpdateOwner_ | Owner
_DatasetUpdateOwner_ | Owner
_DatasetUpdateOwner_ | Any
_DatasetUpdateAny_ | __no__ | | POST | Datasets/_pid_/appendToArrayField | _DatasetUpdate_ |__no__ | __no__ | Owner
_DatasetUpdateOwner_ | Owner
_DatasetUpdateOwner_ | Owner
_DatasetUpdateOwner_ | Any
_DatasetUpdateAny_ | __no__ | @@ -108,13 +115,13 @@ graph LR; | POST | Datasets/_pid_/origdatablocks | _DatasetOrigdatablocksCreate_ | __no__ | __no__ | Owner
_DatasetOrigdatablockCreateOwner_ | Owner
_DatasetOrigdatablockCreateOwner_ | Any
_DatasetOrigdatablockCreateAny_ | Any
_DatasetOrigdatablockCreateAny_ | __no__ | | POST | Datasets/_pid_/origdatablocks/isValid | _DatasetOrigdatablocksCreate_ | __no__ | __no__ | Owner
_DatasetOrigdatablockCreateOwner_ | Owner
_DatasetOrigdatablockCreateOwner_ | Any
_DatasetOrigdatablockCreateAny_ | Any
_DatasetOrigdatablockCreateAny_ | __no__ | | GET | Datasets/_pid_/origdatablocks | _DatasetOrigdatablocksRead_ | Public
_DatasetOrigdatablockReadPublic_ | Has Access
_DatasetOrigdatablockReadOAccess_ | Has Access
_DatasetOrigdatablockReadAccess_ | Has Access
_DatasetOrigdatablockReadAccess_ | Has Access
_DatasetOrigdatablockReadAccess_ | Any
_DatasetOrigdatablockReadAny_ | __no__ | -| PATCH | Datasets/_pid_/origdatablocks/_oid_ | _DatasetOrigdatablocksUpdate_ | __no__ | __no__ | Owner
_DatasetOrigdatablockUpdateOwner_ | Owner
_DatasetOrigdatablockUpdateOwner_ | Owner
_DatasetOrigdatablockUpdateOwner_ | Any
_DatasetOrigdatablockCreateAny_ | __no__ | -| DELETE | Datasets/_pid_/origdatablocks/_oid_ | _DatasetOrigdatablocksDelete_ | __no__ | __no__ | __no__ | __no__ | __no__ | __no__ | Any
_DatasetOrigdatablockDeleteAny_ | +| PATCH | Datasets/_pid_/origdatablocks/_oid_ | _DatasetOrigdatablocksUpdate_ | __no__ | __no__ | Owner
_DatasetOrigdatablockUpdateOwner_ | Owner
_DatasetOrigdatablockUpdateOwner_ | Owner
_DatasetOrigdatablockUpdateOwner_ | Any
_DatasetOrigdatablockCreateAny_ | __no__ | | +| DELETE | Datasets/_pid_/origdatablocks/_oid_ | _DatasetOrigdatablocksDelete_ | __no__ | __no__ | __no__ | __no__ | __no__ | __no__ | Any
_DatasetOrigdatablockDeleteAny_ | | | | | | | | | | | | -| POST | Datasets/_pid_/datablocks | _DatasetDatablocksCreate_ | __no__ | __no__ | Owner
_DatasetDatablockCreateOwner_ | Owner
_DatasetDatablockCreateOwner_ | Owner
_DatasetDatablockCreateOwner_ | Any
_DatasetDatablockCreateAny_ | __no__ | -| GET | Datasets/_pid_/datablocks | _DatasetOrigdatablocksRead_ | Public
_DatasetDatablockReadPublic_ | Has Access
_DatasetDatablockReadAccess_ | Has Access
_DatasetDatablockReadAccess_ | Has Access
_DatasetDatablockReadAccess_ | Has Access
_DatasetDatablockReadAccess_ | Any
_DatasetDatablockReadAny_ | __no__ | -| PATCH | Datasets/_pid_/datablocks/_oid_ | _DatasetDatablocksUpdate_ | __no__ | __no__ | Owner
_DatasetDatablockUpdateOwner_ | Owner
_DatasetDatablockUpdateOwner_ | Owner
_DatasetDatablockUpdateOwner_ | Any
_DatasetDatablockCreateAny_ | __no__ | +| POST | Datasets/_pid_/datablocks | _DatasetDatablocksCreate_ | __no__ | __no__ | Owner
_DatasetDatablockCreateOwner_ | Owner
_DatasetDatablockCreateOwner_ | Owner
_DatasetDatablockCreateOwner_ | Any
_DatasetDatablockCreateAny_ | __no__ | | +| GET | Datasets/_pid_/datablocks | _DatasetOrigdatablocksRead_ | Public
_DatasetDatablockReadPublic_ | Has Access
_DatasetDatablockReadAccess_ | Has Access
_DatasetDatablockReadAccess_ | Has Access
_DatasetDatablockReadAccess_ | Has Access
_DatasetDatablockReadAccess_ | Any
_DatasetDatablockReadAny_ | __no__ | | +| PATCH | Datasets/_pid_/datablocks/_oid_ | _DatasetDatablocksUpdate_ | __no__ | __no__ | Owner
_DatasetDatablockUpdateOwner_ | Owner
_DatasetDatablockUpdateOwner_ | Owner
_DatasetDatablockUpdateOwner_ | Any
_DatasetDatablockCreateAny_ | __no__ | | | DELETE | Datasets/_pid_/datablocks/_oid_ | _DatasetDatablocksDelete_ | __no__ | __no__ | __no__ | __no__ | __no__ | __no__ | Any
_DatasetDatablockDeleteAny_ | | | | | | | | | | | -| GET | Datasets/_pid_/logbook | _DatasetLogbookRead_ | __no__ | Owner
_DatasetLogbookReadOwner_ | Owner
_DatasetLogbookReadOwner_ | Owner
_DatasetLogbookReadOwner_ | Any
_DatasetLogbookReadAny_ | __no__ | +| GET | Datasets/_pid_/logbook | _DatasetLogbookRead_ | __no__ | Owner
_DatasetLogbookReadOwner_ | Owner
_DatasetLogbookReadOwner_ | Owner
_DatasetLogbookReadOwner_ | Owner
_DatasetLogbookReadOwner_ | Any
_DatasetLogbookReadAny_ | __no__ | | diff --git a/Development/v4.x/backend/authorization/authorization_origdatablocks.md b/Development/v4.x/backend/authorization/authorization_origdatablocks.md index 3fbf43e9..a08d3198 100644 --- a/Development/v4.x/backend/authorization/authorization_origdatablocks.md +++ b/Development/v4.x/backend/authorization/authorization_origdatablocks.md @@ -10,9 +10,12 @@ This is the list of the permissions methods available for origdatablock and all ### (Data) Instance Authorization - OrigdatablockCreateOwner - OrigdatablockCreateAny -- OrigdatablockReadPublic -- OrigdatablockReadAccess -- OrigdatablockReadOwner +- OrigdatablockReadManyPublic +- OrigdatablockReadManyAccess +- OrigdatablockReadManyOwner +- OrigdatablockReadOnePublic +- OrigdatablockReadOneAccess +- OrigdatablockReadOneOwner - OrigdatablockReadAny - OrigdatablockUpdateOwner - OrigdatablockUpdateAny @@ -24,9 +27,12 @@ This is the list of the permissions methods available for origdatablock and all graph LR; DatasetOrigdatablockCreate-->DatasetOrigdatablockCreateOwner; DatasetOrigdatablockCreateOwner-->DatasetOrigdatablockCreateAny; - DatasetOrigdatablockRead-->DatasetOrigdatablockReadPublic; - DatasetOrigdatablockReadPublic-->DatasetOrigdatablockReadAccess; - DatasetOrigdatablockReadAccess-->DatasetOrigdatablockReadAny; + DatasetOrigdatablockRead-->DatasetOrigdatablockReadManyPublic; + DatasetOrigdatablockReadManyPublic-->DatasetOrigdatablockReadManyAccess; + DatasetOrigdatablockReadManyAccess-->DatasetOrigdatablockReadAny; + DatasetOrigdatablockRead-->DatasetOrigdatablockReadOnePublic; + DatasetOrigdatablockReadOnePublic-->DatasetOrigdatablockReadOneAccess; + DatasetOrigdatablockReadOneAccess-->DatasetOrigdatablockReadAny; DatasetOrigdatablockUpdate-->DatasetOrigdatablockUpdateOwner; DatasetOrigdatablockUpdateOwner-->DatasetOrigdatablockUpdateAny; DatasetOrigdatablockDelete-->DatasetOrigdatablockDeleteOwner; @@ -38,11 +44,11 @@ graph LR; | -------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | | POST | origdatablocks | _OrigdatablockCreate_ | __no__ | __no__ | Owner
_OrigdatablockCreateOwn_ | Owner
_OrigidatablockCreateOwn_ | Any
_OrigdatablockCreateAny_ | Any _OrigdatablockCreateAny_ | __no__ | | POST | origdatablocks/isValid | _OrigdatablockCreate_ | __no__ | __no__ | Owner
_OrigdatablockCreateOwn_ | Owner
_OrigdatablockCreateOwn_ | Any
_OrigdatablockCreateAny_ | Any
_OrigdatablockCreateAny_ | __no__ | -| GET | origdatablocks | _OrigdatablockRead_ | Public _OrigdatablockReadPublic_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Any
_OrigdatablockReadAny_ | __no__ | -| GET | origdatablocks/_oid_ | _OrigdatablockRead_ | Public
_OrigdatablockReadPublic_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Any
_OrigdatablockReadAny_ | __no__ | -| GET | origdatablocks/fullquery | _OrigdatablockRead_ | Public
_OrigdatablockReadPublic_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Any
_OrigdatablockReadAny_ | __no__ | -| GET | origdatablocks/fullquery/files | _OrigdatablockRead_ | Public
_OrigdatablockReadPublic_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Any
_OrigdatablockReadAny_ | __no__ | -| GET | origdatablocks/fullfacet | _OrigdatablockRead_ | Public
_OrigdatablockReadPublic_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Has Access
_OrigdatablockReadAccess_ | Any
_OrigdatablockReadAny_ | __no__ | +| GET | origdatablocks | _OrigdatablockRead_ | Public
_OrigdatablockReadManyPublic_ | Has Access
_OrigdatablockReadManyAccess_ | Has Access
_OrigdatablockReadManyAccess_ | Has Access
_OrigdatablockReadManyAccess_ | Has Access
_OrigdatablockReadManyAccess_ | Any
_OrigdatablockReadAny_ | __no__ | +| GET | origdatablocks/fullquery | _OrigdatablockRead_ | Public
_OrigdatablockReadManyPublic_ | Has Access
_OrigdatablockReadManyAccess_ | Has Access
_OrigdatablockReadManyAccess_ | Has Access
_OrigdatablockReadManyAccess_ | Has Access
_OrigdatablockReadManyAccess_ | Any
_OrigdatablockReadAny_ | __no__ | +| GET | origdatablocks/fullquery/files | _OrigdatablockRead_ | Public
_OrigdatablockReadManyPublic_ | Has Access
_OrigdatablockReadManyAccess_ | Has Access
_OrigdatablockReadManyAccess_ | Has Access
_OrigdatablockReadManyAccess_ | Has Access
_OrigdatablockReadManyAccess_ | Any
_OrigdatablockReadAny_ | __no__ | +| GET | origdatablocks/fullfacet | _OrigdatablockRead_ | Public
_OrigdatablockReadManyPublic_ | Has Access
_OrigdatablockReadManyAccess_ | Has Access
_OrigdatablockReadManyAccess_ | Has Access
_OrigdatablockReadManyAccess_ | Has Access
_OrigdatablockReadManyAccess_ | Any
_OrigdatablockReadAny_ | __no__ | +| GET | origdatablocks/_oid_ | _OrigdatablockRead_ | Public
_OrigdatablockReadOnePublic_ | Has Access
_OrigdatablockReadOneAccess_ | Has Access
_OrigdatablockReadOneAccess_ | Has Access
_OrigdatablockReadOneAccess_ | Has Access
_OrigdatablockReadOneAccess_ | Any
_OrigdatablockReadAny_ | __no__ | | PATCH | origdatablocks/_oid_ | _OrigdatablockUpdate_ | __no__ | __no__ | Owner
_OrigdatablockUpdateOwner_ | Owner
_OrigdatablockUpdateOwner_ | Owner
_OrigdatablockUpdateOwner_ | Any
_OrigdatablockUpdateAny_ | __no__ | | DELETE | origdatablocks/_oid_ | _OrigdatablockDelete_ | __no__ | __no__ | __no__ | __no__ | __no__ | __no__ | Any
_OrigdatablockDeleteAny_ |