appnote: Add appnote covering Authorisation #115
Conversation
samdbmg
force-pushed
the
sammg-add-authorisation-appnote
branch
from
cc16ad9 to
bcdf5f3
Compare
j616
force-pushed
the
sammg-authentication-methods
branch
from
dbafef9 to
e25a61a
Compare
j616
force-pushed
the
sammg-add-authorisation-appnote
branch
from
bcdf5f3 to
4cd8daf
Compare
|
Converted to a draft PR while we make changes |
j616
force-pushed
the
sammg-add-authorisation-appnote
branch
3 times, most recently
from
fc91efd to
bcd2add
Compare
j616
force-pushed
the
sammg-add-authorisation-appnote
branch
3 times, most recently
from
2cf408f to
9d08f99
Compare
samdbmg
left a comment
samdbmg
left a comment
There was a problem hiding this comment.
This all looks good overall - few nitpicks and suggested wording tweaks inlined
| - name: flow_tag.{name} | ||
| in: query | ||
| description: | | ||
| Filter `referenced_by_flows` on tag values. This option is the same as the `tag.{name}` query parameter on the `/flows/` API endpoint. |
There was a problem hiding this comment.
My gut feeling is that this should also "filter" the flow id from the first_referenced_by_flow field in the same way. Otherwise if we are using this tag query parameter to provide an early implementation of RBAC/ABAC we would be removing a flow id from referenced_by_flows only to leave it visible in first_referenced_by_fMy gut feeling is that this should also "filter" the flow id from the first_referenced_by_flow field in the same way. Otherwise if we are using this tag query parameter to provide an early implementation of RBAC/ABAC we would be removing a flow id from referenced_by_flowsonly to leave it visible infirst_referenced_by_flow. Just a thought and i'm not "wedded to it".low. Just a thought and i'm not "wedded to it".
There was a problem hiding this comment.
I think you're right. But I think what we choose to do here may be affected by the discussion on whether we are happy to elevate auth classes strait to the core spec. So I'll hold off on this change for now.
| - name: flow_tag.{name} | ||
| in: query | ||
| description: | | ||
| Filter `referenced_by_flows` on tag values. This option is the same as the `tag.{name}` query parameter on the `/flows/` API endpoint. |
There was a problem hiding this comment.
As per comment above about also filtering first_referenced_by_flow.
| - name: flow_tag_exists.{name} | ||
| in: query | ||
| description: | | ||
| Filter `referenced_by_flows` on tag names. This option is the same as the `tag_exists.{name}` query parameter on the `/flows/` API endpoint. |
There was a problem hiding this comment.
As per comment above about also filtering first_referenced_by_flow.
| - name: flow_tag_exists.{name} | ||
| in: query | ||
| description: | | ||
| Filter `referenced_by_flows` on tag names. This option is the same as the `tag_exists.{name}` query parameter on the `/flows/` API endpoint. |
There was a problem hiding this comment.
As per comment above about also filtering first_referenced_by_flow.
j616
force-pushed
the
sammg-add-authorisation-appnote
branch
from
1b1ff86 to
2d15d69
Compare
Co-authored-by: Sam Mesterton-Gibbons <sam.mesterton-gibbons@bbc.co.uk>
Also removes a stray optional marker tag.
Add a note that the context in which a request originates may be relevant for an authorization decision.
j616
force-pushed
the
sammg-add-authorisation-appnote
branch
from
71e901a to
5db39a0
Compare
Note that object instance delete requires `write` as the API will not let a user remove all instances of an object directly.
…t the use of new endpoints. Note that coarse grained permissions for webhooks now require read, not write, permissions. This is to avoid a privilege escalation attack where a client with write, but not read, permissions uses websockets to perform read operations.
|
Superseded by #154 |
Details
Adds AppNote 0016 proposing approaches to handling authorisation in TAMS, based on the BBC/AWS workshop in Salford in November 2024.
Jira Issue (if relevant)
Jira URL: https://jira.dev.bbc.co.uk/browse/CLOUDFIT-3534
Related PRs
Merge after #113
If merged after any of the following PRs, add the new endpoints they create to the auth logic listings in this PR. If merged before, add that logic in those PRs
Submitter PR Checks
(tick as appropriate)
Reviewer PR Checks
(tick as appropriate)
Info on PRs
The checks above are guidelines. They don't all have to be ticked, but they should all have been considered.