Changes between Version 14 and Version 15 of BluePrintAuthorization

Timestamp:

06/18/10 21:08:43 (14 years ago)

Author:

Fran Boon

Comment:

--

BluePrintAuthorization

@@ -49 +49 @@
   * Add 2 reusable {{{multiple=True}}} fields to each table which needs this: {{{reader_id}}} & {{{writer_id}}} combined as {{{permissions_id}}}
    * Full backward compatibility since they default to None
-  * reader_id checked with a new API function
+  * reader_id checked with a new API function (called from shn_read() & shn_list(), but also available for other functions)
    * combine with the {{{deleted==True}}} check?
     * makes it easier to then replace that check with an 'inactive' field which is a date instead of a boolean, so that records can be set to expire (as well as giving us easy access to know when a record was deleted)
@@ -93 +93 @@
     * Advantage: Might have better performance than complex DB string?
     * Disadvantage: More records pulled from DB than necessary
-  * writer_id check: All Write access goes via S3XRC so can be checked there (we can also develop an API call for Manual DAL access?)
+  * writer_id checked with a new API function (called from shn_update(), but also available for other functions)
   * UI to manage the fields.
    * We expect relatively few groups per instance, so can use the checkboxes widget?
    * Have a single checkbox for 'Restrict access' which then opens out the 2 fields.
+
 === Specific Examples ===
  * A Person's Contacts shouldn't be visible by default.
@@ -102 +103 @@
    * Simply add the Authenticated group (2) to the table (or records in the table?)
    * ~~This requires all authenticated users to be added to the 'Authenticated' group~~
+
  * A Person's Subscriptions shouldn't be visible by default.
   * Admin or themselves is OK
    * This requires the default of adding 1 group per user!?
+
  * An Admin should be able to restrict access to records to just those within a certain GIS location (e.g. Country or Region)
+
  * If access to a record is restricted then access to messages relating to that record should also be restricted
   * unless routed somewhere visible as well!
   * onaccept on message routing (tagging) to check if the only tags are on restricted resources...if they are then restrict the message too.
+
  * Some tables should be writable by unauthenticated users (writable=|0|)
   * Need special handling for this in shn_create/shn_update?
+   * Might need to differentiate the 2 (can deposit new but not edit existing)
 ----
 BluePrintAuthenticationAccess