chore: enforce permissions #981
Conversation
ctron
force-pushed
the
feature/require_permissions_1
branch
3 times, most recently
from
53da210
to
a553b66
Compare
ctron
force-pushed
the
feature/require_permissions_1
branch
from
a553b66
to
6b897dc
Compare
|
LGTM |
At least you commented. I appreciate that. 😆 |
| } | ||
|
|
||
| #[macro_export] | ||
| macro_rules! all { |
There was a problem hiding this comment.
The pedant in me feels the need to point out that this is a coarse grained perms on REST API eg. that is likely not to easily evolve past securing CRUD on endpoints (ex. securing a single vulnerability, advisory, etc). From an infra pov - we could alternately have nginx or api gateway enforce such things. All that being said - LGTM as designed (just making explicit).
I agree, it's the best we can do today. I think, moving forward, we need much finer grained permissions. And ACL/RBAC/… |
Right now, in most cases, we just require a user to be authenticated. However, we also should provide a minimal authorization, as we did in trustification.