Add API to assign/update owner of a grant about guardian HOT 8 CLOSED

Grants should have owner(s) unless it is undeterminable (like in ImportGrants). If a user doesn't want to receive notifications about certain grants, they should hand them over to someone else.

Yes. Agreed. I meant in a manner of -
Could we have similar restrictions in the way we add/remove approvers for a given step. We check to ensure at least one approver is present in case of removal. We should be able to do that here also.

from guardian.

Agreed on the second approach with restrictions on what can be updated. 👍

from guardian.

@ravisuhag @haveiss @mabdh @bsushmith requesting for your comments 🙏

from guardian.

This feature will also help us in assigning a new owner in case the previous owner is not part of the organization.
For example, we see for serviceAccounts, the previous owners are no longer in the org, and then nobody gets any reminders when a particular serviceAccount grant eventually expires.

Would it be possible to remove owners also? In case somebody wants to re-assign their ownership and does not want to be notified about it?

In the proposed options - I feel option2 might lead to abuse as people might use this to update other fields even if they are not intended to be.

from guardian.

Would it be possible to remove owners also? In case somebody wants to re-assign their ownership and does not want to be notified about it?

Grants should have owner(s) unless it is undeterminable (like in ImportGrants). If a user doesn't want to receive notifications about certain grants, they should hand them over to someone else.

In the proposed options - I feel option2 might lead to abuse as people might use this to update other fields even if they are not intended to be.

this API should only work on allowed fields. For now, I think it'll be only owner, later after we introduced co-owners we can also add them.

from guardian.

Yeah, I feel the 2nd solution is simpler. But do we need to restrict the caller of the API? So not all people could update the owner field.

For the next co-owners: []string, I am not sure if it is that scalable to do so, but I think that could be discussed later.

from guardian.

But do we need to restrict the caller of the API?

@mabdh the API restriction will be done from the auth proxy (shield) only, as right now that's how we configure superadmin privileged APIs as well

from guardian.

@bsushmith @mabdh can we sign off on the preferred approach? if so I'll work on this soon

from guardian.