This checks workspace ID access on the sublinked objects and tweaks some of the query for performance using arango's explain feature
So below is the "correct" (I think) access control logic for the complicated workspace system for the gsp UI query:
downstream references have read permissions regardless of the workspace
upstream references have read permissions if the user has access to the workspace
downstream provenance has read perms if the user has access to the workspace
upstream provenance has read perms regardless of the workspace
upstream or downstream copies have read perms if the user has access to the workspace
I found that overly complicated to implement in a query though. So instead we have kind of a subset of the above behavior in the query -- we always check for workspace access on every traversal. I think that's good enough for the short term.
This checks workspace ID access on the sublinked objects and tweaks some of the query for performance using arango's explain feature
So below is the "correct" (I think) access control logic for the complicated workspace system for the gsp UI query:
I found that overly complicated to implement in a query though. So instead we have kind of a subset of the above behavior in the query -- we always check for workspace access on every traversal. I think that's good enough for the short term.