threebot security [development_security]

[despiegk]

features

• [x] actor security
• [x] acl security - [ ] crud actors integration with security
• [ ] integration with threebot_connect - for next release see #497
• [ ] revisit weblayer for websites - for next release
• [ ] revisit weblayer for gedis for using JSX gedis client (gedis using https)

actor security

• admin user = threebot user, only he can go to actors by default
• need to use the session object to make sure only admin (own user) can access
• you can have multiple admin (so suggest to use the circle:admin for that purpose)

remark for actor methods

• or method is 100% public (need to specify, maybe a decorator?)
• or default is method only accessible by admins
• or in actor method we deal with checking the circles membership
• [ ] update base crud actor to check for the required right in each method:
  • [ ] new > w
  • [ ] set > w
  • [ ] get > r
  • [ ] delete > d

todo

phase 1

phase 2

• [x] update actors to use usersession threefoldtech/jumpscaleX_core#329

[xmonader]

• actor security is already merged https://github.com/threefoldtech/jumpscaleX_core/pull/205
• more work on the integration with threebot client is actively being done as part of threebot client story https://github.com/threefoldtech/jumpscaleX_core/pull/187
• crud actors already been merged (https://github.com/threefoldtech/jumpscaleX_threebot/tree/development/ThreeBotPackages/zerobot/models_crud)
• acl security is already merged here https://github.com/threefoldtech/jumpscaleX_core/blob/development/JumpscaleCore/data/bcdb/models_system/ACL.md

[despiegk]

make sure all further work done around security on this branch and this branch only

[xmonader]

@andrewayoub already started working on this

[xmonader]

blocked on https://github.com/threefoldtech/home/issues/492

[rkhamis]

we should open a new one when approach is clearer