cs3org / cs3apis

:arrows_clockwise: Connect Storage and Application Providers
https://buf.build/cs3org-buf/cs3apis
Apache License 2.0
53 stars 29 forks source link

add new user type space owner #187

Closed butonic closed 2 years ago

butonic commented 2 years ago

When accessing public shares in a project space (which has no owner, only managers) we need to be able to pass a userid through the system which permission checks can work with.

Another use case is when trying to index a space on behalf of the space owner.

In both cases the user id MUST be set to the space id to reflect which space is supposed to be indexed.

Signed-off-by: Jörn Friedrich Dreyer jfd@butonic.de

micbar commented 2 years ago

We are currently using USER_INVALID, why do we need an additional type?

butonic commented 2 years ago

@micbar you added it in https://github.com/cs3org/reva/blob/8f35682de6b785c96c215d6af5dea9508cfe3a9a/pkg/auth/manager/publicshares/publicshares.go#L132 and https://github.com/cs3org/reva/blob/8f35682de6b785c96c215d6af5dea9508cfe3a9a/pkg/storage/utils/decomposedfs/grants.go#L69

for non personal spaces in https://github.com/cs3org/reva/pull/3029 it seems

labkode commented 2 years ago

Hi guys, a space owner looks like an internal type of user. Let's take CERNBox as example, a space owner can be any of these:

USER_TYPE_PRIMARY = 1;
  // A secondary user for cases with multiple identities.
  USER_TYPE_SECONDARY = 2;
  // A user catering to specific services.
USER_TYPE_SERVICE = 3;

and maybe in the future other types will be guest or federated.

To have an internal type of user, the USER_TYPE_APPLICATION = 4; was created for that.

micbar commented 2 years ago

Not really. A space owner is not a real user on reva edge. It has no account in the IDP and will never be able to log in. Therefore it is important to have a dedicated user type. I was also happy with USER_INVALID but that makes it clearer.

glpatcern commented 2 years ago

Yet it is given privileges to do actions. I reckon that the USER_TYPE_APPLICATION would be a good fit here

glpatcern commented 2 years ago

@micbar @butonic do you use USER_TYPE_APPLICATION anywhere else, and would you need to make a distinction with this specific case? If not, for the sake of keeping the API clean I'd be in favour of using USER_TYPE_APPLICATION and reverting this change.