TBD54566975 / dwn-sdk-js

Decentralized Web Node (DWN) Reference implementation
https://identity.foundation/decentralized-web-node/spec/
Apache License 2.0
326 stars 105 forks source link

Allow tenant and PermissionsGrant holders to update protocol records authored by someone else #476

Closed diehuxx closed 2 months ago

diehuxx commented 1 year ago

Context: https://github.com/TBD54566975/dwn-sdk-js/pull/474#discussion_r1296533888

There is currently a condition enforced for protocol RecordsWrites that only the initial author of a record can update the record. Not even the tenant can update a protocol record authored by someone else. Should we allow the tenant to update all records in their DWN? Should we allow PermissionsGrant grantees update records they did not initially author?

Reasons against: If the tenant wishes to remove the content of a record, they can just delete the record and create a new record. Reasons for: The tenant is the monarch of their DWN. They should have access to create, update, read, or delete any record on their DWN.

LiranCohen commented 1 year ago

If my understanding of the issue is correct I vote for allowing tenant to do anything to any record, as well as allowing any grantee to do anything the grant authorizes.

If a tenant wants to change a record that someone else authored into their DWN via a protocol, that could be useful.

A Delete then a subsequent Create of a new record removes the original author from potentially being able to further read/update it depending on protocol rules. If the intention of the tenant is to remove that ability they can still do that by issuing a delete, but if their intention is simply to update a record someone else authored i think that should be allowed.

thehenrytsai commented 2 months ago

The implementation of co-update, co-delete, and co-prune should already address this.