Implement proper ACL checks and suid permission #157
Conversation
|
Needs the following:
|
| sink_req.content_length = source_resp.content_length | ||
| sink_req.content_type = source_resp.headers['Content-Type'] | ||
| sink_req.etag = source_resp.etag | ||
| req_iter = iter(source_resp.app_iter) | ||
| req = sink_req | ||
| self.authorize_job(req, remove_auth=False) |
There was a problem hiding this comment.
Shouldn't there be a acl= argument here? Perhaps: self.authorize_job(req, acl='read_acl', remove_auth=False)?
There was a problem hiding this comment.
No, job can be pre-authorized by owner only. No read or write permissions matter here.
There was a problem hiding this comment.
Okay. By the way, I'm unable to get anonymous access working. Have you exercised this functionality yet?
There was a problem hiding this comment.
I did not do any anonymous stuff tests yet, and there should be bugs there.
|
@pkit Can you give me some ideas about how to set up the tests for |
|
For example, I can't figure out how--with the test utils and fixtures--to set up a zapp to handle requests for |
| @@ -45,6 +45,8 @@ def handle_chain(self, env, start_response): | |||
| new_req.environ['chain.input'] = env['chain.input'] | |||
| new_req.environ['chain.input_size'] = env['chain.input_size'] | |||
| new_req.environ['chain.input_type'] = env['chain.input_type'] | |||
| if 'zerovm.source' in env: | |||
There was a problem hiding this comment.
Why is this being copied? There's no explanation in comments or in a commit message.
There was a problem hiding this comment.
We need to know which chains come from api/1.0 requests and which are just user-created. Only api/1.0 ones need to be checked on suid secirity.
There was a problem hiding this comment.
Okay, can you please add a comment explaining that here?
|
According to the spec for this feature, the suid stuff should only apply to api/1.0 and open/1.0 features. However, the tests so far implemented on this branch test suid features of everything BUT the REST features. Why is that? Do we need to update the spec? |
|
Added example with API/1.0 call, fixed a bug regarding anonymous access to API endpoint. |
|
See #172 for a rebased version of this branch. |
Placeholder, not finished yet.
Tests needed still:
Anonymous (api/1.0):