search

elixir-cloud-aai / cloud-registry

GA4GH Service Registry API implementation for the ELIXIR Cloud
Apache License 2.0
4 stars 1 forks source link

feat: add access control #43

Open alohamora opened 1 year ago

alohamora commented 1 year ago

Add access control configuration to restrict the permissions over the following methods

  1. All GET endpoints, as well as the POST /services endpoint should be accessible to every authenticated user, that is, no specific access policies apply.
  2. Users who post a new service become their Owner. Owners can set the roles for other users, to Owner or Maintainer, for that particular resource. They can also DELETE and edit (PUT) services.
  3. Maintainers can only edit (PUT) services, but not delete or set roles for other users.
  4. Admins of the service are the only ones who can use the POST service-info/ endpoint and give other users Admin permissions. One or more Admins should be configured when a service is initially deployed (probably via the config). Admins can not modify or delete services or set Owner or Maintainer permissions for services that they do not own, so the Admin role is really restricted to setting the service info of the registry itself.