Identify the scope of access control needed for this sprint and implement just enough

tattle-made / kosh-v2

3 stars 4 forks source link

Identify the scope of access control needed for this sprint and implement just enough #26

Closed dennyabrain closed 2 years ago

dennyabrain commented 2 years ago

In its current scope, access control would mean the following categories of checks :

Role Check :

[ ] Users with role of uploader or viewer should not be able to access endpoints meant for admin user. This would involve any endpoint for /index

Ownership Check :

[ ] Ensuring that uploaders or tokens associated with them can only be used to read/write/update media belonging to datasets they have created.

dennyabrain commented 2 years ago

In the current state when there is no caching and only limited number of datasets and owners, I wonder if its worth attempting loading and retaining user and dataset data in memory at server startup. This way ownership checks and role checks should not need database calls.