search

joyent / conch-api

Datacenter build and management service
Mozilla Public License 2.0
22 stars 11 forks source link

reduce device-level permission checks that look in user_relay_connection to 'ro' #785

Open karenetheridge opened 5 years ago

karenetheridge commented 5 years ago

Presently, one of the ways in which a user is granted access to view/modify a device is having sent a device report proxied by a relay that is using the user's credentials. This is unwieldy, and coupled with the v3 concept of organizations, will be unnecessary. Remove it.

sungo commented 5 years ago

We'll need to talk to folks about this. The use case for that lookup is a real one but it might have changed given the edge user behavior we've seen in the last six months.

karenetheridge commented 5 years ago

Unless something changes, this is not on for v3.

karenetheridge commented 5 years ago

Relay users should still be able to access devices, but they should only be given read-only access. At present they have 'admin' level access because they are updating device settings, so first we need to resolve https://github.com/joyent/conch-relay/issues/190 and https://github.com/joyent/conch-livesys/issues/150.

karenetheridge commented 4 years ago

We can remove this check in 3.1. related to #598.