Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new endpoint checkpermissions #2047

Merged

Conversation

hu-ahmed
Copy link
Contributor

@hu-ahmed hu-ahmed commented Oct 21, 2024

fixes #1137

This PR introduces the implementation of the /checkPermissions endpoint in Ditto’s API, enhancing the authorization model by allowing permission checks on thing, message, and policy resources without modifying them. This endpoint validates whether specified entities have the required permissions for resources, returning authorization statuses in the response. This feature is particularly beneficial for UI-driven applications that rely on dynamic permission-based display logic, where interface elements can be enabled or disabled based on user access rights. Documentation includes usage examples, request structure, and response details.

Example Request
A POST request to /checkPermissions to verify permissions for multiple entities:

{
  "lamp_reader": {
    "resource": "thing:/features/lamp/properties/on",
    "entityId": "org.eclipse.ditto:some-thing-1",
    "hasPermissions": ["READ"]
  },
  "lamp_toggler": {
    "resource": "message:/features/lamp/inbox/messages/toggle",
    "entityId": "org.eclipse.ditto:some-thing-1",
    "hasPermissions": ["WRITE"]
  },
  "policy_admin": {
    "resource": "policy:/",
    "entityId": "org.eclipse.ditto:some-policy-1",
    "hasPermissions": ["READ", "WRITE"]
  }
}

Example Response

{
  "lamp_reader": true,
  "lamp_toggler": false,
  "policy_admin": true
}

@hu-ahmed hu-ahmed marked this pull request as draft October 21, 2024 07:34
@hu-ahmed hu-ahmed force-pushed the add-permission-availability-api branch from d9de88f to aec95e4 Compare October 21, 2024 07:39
@thjaeckle thjaeckle added this to the 3.7.0 milestone Oct 21, 2024
Copy link
Member

@thjaeckle thjaeckle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot @hu-ahmed for the PR.
Functionality already looks good, I had a first look and did some inline comments.

We should definitely add some unit tests as well for this feature (model classes + for the actor + for the HTTP route).
Javadoc has to be added for every public class/method, etc. .. so choose wisely what to make "public" and what not ;)

Copy link
Member

@thjaeckle thjaeckle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great progress, @hu-ahmed - thanks a lot. 👍
I did another round of review and provided feedback inline, please have a look :)

@hu-ahmed hu-ahmed force-pushed the add-permission-availability-api branch from d6d9d0e to 7588065 Compare October 28, 2024 20:35
@hu-ahmed hu-ahmed marked this pull request as ready for review October 29, 2024 09:30
@hu-ahmed hu-ahmed marked this pull request as draft October 29, 2024 09:54
Copy link
Member

@thjaeckle thjaeckle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added some remarks for the added documentation.

Copy link
Member

@thjaeckle thjaeckle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some few minor fixes needed ..

@hu-ahmed hu-ahmed marked this pull request as ready for review October 31, 2024 07:41
@thjaeckle
Copy link
Member

@hu-ahmed changes look good to me 👍 Thanks a lot for your patience.

Looking forward to a system test: https://github.com/eclipse-ditto/ditto-testing

@thjaeckle
Copy link
Member

@thjaeckle thjaeckle merged commit df6f261 into eclipse-ditto:master Nov 6, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

Introduce policy decision API
2 participants