Actions
User Story #289
open
Epic #49: Implement user, groups and permissions management
Feature #269: Access decision and enforcement
As an operator, I want every protected action checked before it runs, so that access rules cannot be bypassed by choosing another way in
User Story #289:
As an operator, I want every protected action checked before it runs, so that access rules cannot be bypassed by choosing another way in
Start date:
Due date:
% Done:
0%
Estimated time:
Description
Rules only count if they apply to the interface, the API and the command line equally, and if a refusal is a clear answer rather than a broken page.
Acceptance criteria
- Every action that needs a capability is checked before it has any effect
- A refusal is returned clearly and consistently, and says what was required
- The same check applies whichever way the action was reached
- Lists only contain what the requester is allowed to see, rather than being filtered afterwards
- Nothing that is not explicitly allowed is permitted
Rejection reason
Superseded by the rewritten epic #49
Updated by
Actions