Issue 350, 352 #353
Issue 350, 352 #353
Conversation
Merge Upstream
Removed READ ALL NODES from default permissions for the USER role.
Altered the business policy search api to limit which nodes are visible to the user role.
Merge Upstream
Added v2.24.0 changes to readme. Removed testing container.
|
All local and Anax tests have passed. |
| -e "EXCHANGE_IAM_EMAIL=$$EXCHANGE_IAM_EMAIL" \ | ||
| -e "EXCHANGE_IAM_ACCOUNT_ID=$$EXCHANGE_IAM_ACCOUNT_ID" \ | ||
| $(DOCKER_NAME)_test /bin/bash -c 'cd $(EXCHANGE_API_DIR) && sbt test' | ||
| - sbt test |
There was a problem hiding this comment.
How does the travis process have sbt, scala, and java installed?
There was a problem hiding this comment.
Java and Scala are defined at lines 2 - 4 of the Travis yaml. When defining Scala as your language Travis will automatically search for a build.sbt and pull-down sbt just before the script phase in the yaml.
| logger.debug("ident.role.equals(AuthRoles.Agbot): " + ident.role.equals(AuthRoles.Agbot)) | ||
| logger.debug("ident.role: " + ident.role) | ||
| logger.debug("(ident.isAdmin || ident.role.equals(AuthRoles.Agbot)): " + (ident.isAdmin || ident.role.equals(AuthRoles.Agbot))) | ||
| logger.debug("ident.getIdentity: " + ident.getIdentity) |
There was a problem hiding this comment.
Do you really want all of these debug statements long term? Or were they just to verify this code change?
There was a problem hiding this comment.
I meant to clean all of the up before pushing.
| logger.debug("ident.role: " + ident.role) | ||
| logger.debug("(ident.isAdmin || ident.role.equals(AuthRoles.Agbot)): " + (ident.isAdmin || ident.role.equals(AuthRoles.Agbot))) | ||
| logger.debug("ident.getIdentity: " + ident.getIdentity) | ||
| if (ident.isAdmin || ident.role.equals(AuthRoles.Agbot)) { |
There was a problem hiding this comment.
I think i agree with sadiyah that it will be much less confusing to the non-admin user if we prevent him from running this route vs. let him run it but return less nodes.
So i think it best to remove your changes in this route, because that way exchAuth(TNode(OrgAndId(orgid,"#").toString), Access.READ) will reject a non-admin user.
There was a problem hiding this comment.
Business policy search changes have been reverted.
|
This PR also addresses: #352 |
References #350, #352
Changes:
read_all_nodesfrom default permissions foruserrole, and removedread my nodesfrom default permissions fornoderole.