Changes between Initial Version and Version 1 of AccessControl

Timestamp:

08/27/09 12:32:32 (5 years ago)

Author:

rgrp

Comment:

detailed first sketch

AccessControl

@@ +1 @@
+= Access control =
+
+[[PageOutline]]
+
+== Use Cases ==
+
+  * A user means someone who is logged in.
+  * A visitor means someone is not logged in.
+  * An entity is the subject of a permission (either a user or a pseudo-user)
+
+1. A visitor visits a package page and reads the content
+
+2. A visitor visits a package page and edits the package
+
+3+4: Ditto for a user
+
+5. On package creation if done by a user and not a visitor then user is made the 'admin'
+
+6. An admin of a package adds a user as an admin
+
+7. An admin of a package removes a user as an admin
+
+8. Ditto for admin re. editor
+
+9. Ditto for admin re. reader
+
+10. We wish to be able assign roles to 2 specific entire groups in addition to specific users: 'visitor', 'users'. These will be termed pseudo-users as we do not have AC 'groups' as such.
+
+11. The sysadmin alters the assignment of entities to roles for any package
+
+12. A visitor goes to a package where the editor role does not include 'visitor' pseudo-user. They are unable to edit the package.
+
+13. Ditto for user where users pseudo-user does not have editor role and user is not an editor for the package
+
+14+15: Ditto for above re reader role ...
+
+
+== Optional ==
+
+  * Support for access-related groups
+  * Support for blacklisting
+
+
+== Implementation ==
+
+{{{
+    Context
+Entity ----> Roleckage | role | group
+---------------------------
+xyz     | admin     | admin
+xyz     | edit      | anonymous
+xyz     | read      | anonmyous
+xyz     | purge     | editor
+
+
+    Context
+Role ----> Action/Permission/Capability (on an Object e.g. a Package)
+}}}
+
+
+Package level:
+
+  * Package Roles: admin, editor, readerckage | role | group
+---------------------------
+xyz     | admin     | admin
+xyz     | edit      | anonymous
+xyz     | read      | anonmyous
+xyz     | purge     | editor
+
+  * Entities: [email protected] (user), pseudo-users 'visitor'
+  * Assignment of entities to roles in a given context (the package)
+  * Roles give permissions (in a given context)
+    * admin -> update assignment to roles, delete package, plus editor
+    * editor -> update package plus reader
+    * reader -> read package
+
+System level permissions:
+ckage | role | group
+---------------------------
+xyz     | admin     | admin
+xyz     | edit      | anonymous
+xyz     | read      | anonmyous
+xyz     | purge     | editor
+
+  * Roles:??
+  * create package 
+  * update assignment of system level role
+
+=== Determining permissions ===
+
+{{{
+def is_allowed(name, action, context=None):
+    user = locate_user(name)
+    if not user:
+        # they are a visitor ...
+   
+    if context is None:
+        context = 'system'
+    contextroles = locate_roles(user, context)
+    if context != 'system':
+        sysrole =
+        if sysrole = 'sysadmin':
+            # can do anything ...
+            return True
+    for role in contextroles:ckage | role | group
+---------------------------
+xyz     | admin     | admin
+xyz     | edit      | anonymous
+xyz     | read      | anonmyous
+xyz     | purge     | editor
+
+        # assuming 'ORing' of permissions
+        if role.is_allowed(action)
+            return True
+    if visitor:
+        visitor_role = locate_roles(visitor, context)
+        # check again
+    return False
+}}}
+ckage | role | group
+---------------------------
+xyz     | admin     | admin
+xyz     | edit      | anonymous
+xyz     | read      | anonmyous
+xyz     | purge     | editor
+
+=== Initializing Permissions for a Package ===
+
+ when we create a package: visitor is given reader and editor roles automatically (ditto for user)
+
+=== DB Sketch ===
+
+{{{
+role-table
+
+name | context | action
+admin| package | update
+admin| package | update-permissions
+admin| package | read
+editor| package | update
+editor| package | read
+
+user-role-table
+
+username | context_type | objectid | role
+xyz      | package | geonames | admin
+rgrp     | system  |   | admin
+visitor  | package |   | reader
+visitor  | package | geonames  | editor 
+visitor  | package | geonames | reader
+
+}}}