Standard Method List should include authorization as a reason for partial result

[squee1945]

https://google.aip.dev/132#response-message says:

The response should usually include fully-populated resources unless there is a reason to return
a partial response (see [AIP-157](https://google.aip.dev/157)).

AIP-157 mentions only performance as a reason for partial responses:

Sometimes, a resource can be either large or expensive to compute, and the API needs to give the
user control over which fields it sends back.

It seems that Authorization is another reason to return partial results. For example, a list permission may may only allow access to resource metadata, while a get permission would allow access to the resource metadata and the resource data.

Is authorization a valid reason to return partial responses from a List operation?

[15xobo]

Voting up this issue. Authorization is a very valid concern. In many use cases, we need a List operation to only retrieve the ID/names and some other metadata. If needed and permitted, users can subsequently retrieve the full resource/objects through Get/BatchGet. An example is the ls command in Linux. Permissions to enter and ls a directory doesn't necessarily imply permissions to read the files in the directory.

The List API specified in AIP-132 is too restrictive and it's pretty much a simplified variant of BatchGet. Users with List permission effectively have Get access to all resources in a collection, even though they may not have the Get permissions to individual resources. This can be counterintuitive, and I don't think the "List" verb is well-known to be equivalent to "Get All".

I think the partial result restrictions should be loosen to give us the flexibility to fulfill these cases with the standard List API.