store ACEs by client/user #240
Conversation
Chef Server has the ability to return users and clients separately within an GET ACL request when `detail=granular`. To support that, we need to store them separately and determine if we want to present `actors` or `users` and `clients` at the time of the request. This change makes a reasonable best effort at capturing the creator type (user v client) correctly and uses that for determining its assignment in acls.
|
Looks sane enough to me. |
|
Tapping @jkeiser for a review :) Maybe @randomcamel or @danielsdeleo as well? |
|
LGTM |
| @@ -22,6 +22,17 @@ def get(request) | |||
| end | |||
| acls = FFI_Yajl::Parser.parse(get_data(request, acl_path), :create_additions => false) | |||
| acls = ChefData::DataNormalizer.normalize_acls(acls) | |||
| if request.query_params["detail"] == "granular" | |||
| acls.each do |perm, ace| | |||
| acls[perm]["actors"] = [] | |||
There was a problem hiding this comment.
Out of curiosity - does it make sense to leave all the actors in here even if granular is requested? I don't know who uses this field.
There was a problem hiding this comment.
This is mirroring the behavior that we added to the Chef Server, where if you request granular actors will be empty but users and clients will not.
This prevents someone from using a modified version of the GET response to PUT an acl update, and getting an error because Chef Server won't except a PUT body with both actors and users/clients.
It's a bit awkward, but is the path least likely to break existing tooling outside of what we maintain - the most common method of modifying ACLs is to request the ACLs, modify a single ACE, and PUT it back to the server.
|
👍 but I'm a n00b. |
Chef Server has the ability to return users and clients separately
within an GET ACL request when
detail=granular. To support that,we need to store them separately and determine if we want to present
actorsorusersandclientsat the time of the request.This change makes a reasonable best effort at capturing the creator
type (user v client) correctly and uses that for determining its
assignment in acls.