UserContext: capabilities from runtime roles should not auto-persist via getRefreshed()

mrclay / ScopedRole

A Contextual Role-Based Permissions Manager

3 stars 0 forks source link

UserContext: capabilities from runtime roles should not auto-persist via getRefreshed() #4

Open mrclay opened 13 years ago

mrclay commented 13 years ago

To make getPersistedCapabilities more accurate I copied the capabilities that come with runtime roles into runtimeCapabilities. The problem is that, if that capability were removed from the runtime role, it would still be propagated in getRefreshed(). It's better to just remove getPersistedCapabilities() than risk granting a user a capability that's been removed from one of her roles.

mrclay commented 9 years ago

Get rid of "runtimeCapabilities" altogether