User Roles/Permissions about torrust-index-archive HOT 2 CLOSED

I've created the summary below with the current state. I think it's useful to define first what we have before proposing new changes.

I called the "UNVERIFIED" user "AUTHENTICATED" and there is no "MODERATOR".

For the first implementation I would:

• Create a permissions service only for commands and queries: service.is_authorized(user, action).
• Call the service in the handlers before performing the action.
• We can add a wrapper to return the right HTTP response.
• Can add unit tests for the service and integration tests for the API endpoints.

IMPLEMENTATION NOTES:

• Roles could be hardcoded.
• Rules could also be hardcoded for the time being inside the service.

NOTES:

• Regarding settings I would split them into two groups: the ones you only set while installing the application (they could be injected as env vars in the future), and the ones you can change dynamically like the "site name". I would move the second group to a database table. If you need to restart the service after changing the value it does not make sense to allow you to change it from the web app.
• API resources do not contain any sensitive data except for "username" and "settings" so I do not think it worth creating specific resources depending on the role. It seems the general rule is either you can see the full resource or you cannot see the resource.

QUESTIONS:

• The "username" is not considered private data.

from torrust-index-archive.

• torrust/torrust-index#211

from torrust-index-archive.