search

sandstorm-io / sandstorm

Sandstorm is a self-hostable web productivity suite. It's implemented as a security-hardened web app package manager.
https://sandstorm.io
Other
6.72k stars 705 forks source link

Restrict access to grain #1976

Open OliverHi opened 8 years ago

OliverHi commented 8 years ago

Hi,

I have set up a sandstorm server for a small group of people to use and I am currently "fighting" with access control. I want to be able to create a lets say etherpad spreadsheet and then invite someone else to work with me on it. That works via the share button/links. The problem is that these people seem then to be able to invite anyone else too (and can I even see who?). Can I somehow stop that? Same problem with just the links. Any way to perhaps create links that work only for a certain time or just once?

Thanks for your help! If some of these features don't exist (yet) I would love to have them added to the system

kentonv commented 8 years ago

Hi Oliver,

The short answer is that restricting resharing will be possible eventually, but is not there yet. However, you should keep in mind that it is not actually possible to prohibit a malicious user from resharing; it's only possible to create speedbumps to discourage non-malicious users.

The long answer is this blog post, which describes at length why we choose to allow resharing by default and how we will eventually introduce "policies" which let you restrict resharing: https://sandstorm.io/news/2015-05-05-delegation-is-the-cornerstone-of-civilization