search

caTUstrophy / backend

Backend part for our catastrophe aid tool. Written in Go.
GNU General Public License v3.0
6 stars 3 forks source link

permission/CheckScope not used everywhere #92

Closed jeichelbaum closed 8 years ago

jeichelbaum commented 8 years ago

eg. CreateRegion can be done by anyone, create region with global size boundaries results in global admin access

nielsrolf commented 8 years ago

The creator of a region is not automatically its admin. Maybe instead of this, a system admin should confirm a region and regions get a flag for this?

nielsrolf commented 8 years ago

One way would be: we add a confirmed flag to regions which is set to true if the author is a system admin. Otherwise, the flag defaults to false. A region that is created by a user can be updated with the usual put /regions/:regionID.

jeichelbaum commented 8 years ago

Error was on my end I didnt realize everybody is allowed to create regions