Recognize the endpoint editor role as the write tier - #237
Merged
Conversation
The write-operation gate accepted the write tier only through ndp_writer
and group:{ep}:writer, but the identity provider and the platform name
that tier editor, not writer: the roles it issues are
group:ndp_ep/ep-{id}:editor and the per-endpoint permission levels are
admins/editors/viewers. So an editor of an endpoint was denied create,
update and delete, though the role is meant to grant exactly that.
Administrators were unaffected, so only the middle tier was blocked.
is_writer now accepts ndp_editor and group:{ep}:editor alongside the
writer forms. Additive — nothing that was allowed before is removed.
Closes #236
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #236
Problem
The write-operation gate recognized the write tier only through
ndp_writerandgroup:{ep}:writer. But the identity provider and the platform name that tier editor, not writer — the roles it issues aregroup:ndp_ep/ep-{id}:editor, and the per-endpoint permission levels created for a client are admins/editors/viewers (verified against a token and against a client created through the new/client/create).So a user who is an editor of an endpoint was denied create, update and delete, even though the role is meant to grant exactly that. Administrators were unaffected; only the middle tier was blocked.
Fix
is_writernow acceptsndp_editorandgroup:{ep}:editoralongside the writer forms. Additive — nothing previously allowed is removed.Verified
New
tests/test_editor_is_writer.pyuses the exact emitted rolegroup:ndp_ep/ep-{id}:editor: an editor resolves tois_writertrue /effective_rolewriter, a platformndp_editoris a writer, and a plain viewer is still not. Full suite 1212 passed;black/flake8clean.Context: this is the ep-api side of the viewer/writer/admin vs viewer/editor/admin naming — the platform uses editor, so ep-api accepts it.