{"action":"created","issue":{"url":"https://api.github.com/repos/certsocietegenerale/FIR/issues/127","repository_url":"https://api.github.com/repos/certsocietegenerale/FIR","labels_url":"https://api.github.com/repos/certsocietegenerale/FIR/issues/127/labels{/name}","comments_url":"https://api.github.com/repos/certsocietegenerale/FIR/issues/127/comments","events_url":"https://api.github.com/repos/certsocietegenerale/FIR/issues/127/events","html_url":"https://github.com/certsocietegenerale/FIR/pull/127","id":176836862,"number":127,"title":"Business line based authorization","user":{"login":"gcrahay","id":5130612,"avatar_url":"https://avatars.githubusercontent.com/u/5130612?v=3","gravatar_id":"","url":"https://api.github.com/users/gcrahay","html_url":"https://github.com/gcrahay","followers_url":"https://api.github.com/users/gcrahay/followers","following_url":"https://api.github.com/users/gcrahay/following{/other_user}","gists_url":"https://api.github.com/users/gcrahay/gists{/gist_id}","starred_url":"https://api.github.com/users/gcrahay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gcrahay/subscriptions","organizations_url":"https://api.github.com/users/gcrahay/orgs","repos_url":"https://api.github.com/users/gcrahay/repos","events_url":"https://api.github.com/users/gcrahay/events{/privacy}","received_events_url":"https://api.github.com/users/gcrahay/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-14T07:40:46Z","updated_at":"2016-09-14T09:04:36Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/certsocietegenerale/FIR/pulls/127","html_url":"https://github.com/certsocietegenerale/FIR/pull/127","diff_url":"https://github.com/certsocietegenerale/FIR/pull/127.diff","patch_url":"https://github.com/certsocietegenerale/FIR/pull/127.patch"},"body":"## General\r\n\r\nThe goal of this PR is to restrict access to events and incidents. These restrictions are enforced:\r\n* At the global level: if the user has permissions directly attached or via a group, these permissions are valid on all business lines (no behaviour change).\r\n* At a local level: if the user has permissions attached to a business line (via the new `AccessControlEntry` model), these permissions are valid on this business line and its descendants (and all events/incidents with them in `concerned_business_lines`).\r\n\r\nThe user admin form allows to add and edit access control entries.\r\n\r\nThe `BusinessLine` model uses [Django Treebeard](https://bitbucket.org/tabo/django-treebeard/overview) materialized path implementation to efficiently search for business line descendants and ancestors.\r\n\r\nThis PR is related to issue #62. It should fix #91.\r\n\r\nIt's quite extensive and needs an in-depth review. The stats (I don't use it) part was the trickier.\r\n\r\n## Permissions\r\n\r\nCode | Name | Description\r\n-----|:-----|:----------------\r\n`incidents.handle_incidents` | Can handle incidents | User can add/edit incident and add items (attributes, todo items, nuggets,...).\r\n`incidents.view_incidents` | Can view incidents | User can list and display incident details. If setting `INCIDENT_VIEWER_CAN_COMMENT` is True, user can comment the incident (edit and delete his own comments).\r\n`incidents.view_statistics` | Can view statistics | User can view statistics. If the statistics page have an incident list, only incidents the user can view (`incidents.view_incidents`) are shown.\r\n`incidents.report_events` | Can report events | User can create new events (no incident).\r\n\r\n### Settings\r\n\r\nTo customize permissions behaviour, some settings can be set.\r\n\r\nName                              |  Default   |  Description\r\n----------------------------------|------------|-----------------------------------\r\nINCIDENT_VIEWER_CAN_COMMENT       | `True`     | User with `incidents.view_incidents` permission on a business line in the incident `concerned_business_lines` can comment it.<br>When `False`, user must have `incidents.handle_incidents` permission to comment. \r\nINCIDENT_CREATOR_PERMISSION   | `incidents.view_incidents`     | Additional permission to the user who created the incident (`opened_by`). `None` for no additional permission.\r\n\r\n## Default roles (groups)\r\n\r\nRoles are regular Django groups. Roles are groups of permissions, easing user rights management. \r\n\r\nIf the role is added as a Djanog group to the user model, its permissions are valid for all business lines and incidents.\r\n\r\nName                     | Permissions\r\n-------------------------|-------------\r\nIncident handlers | `incidents.handle_incidents`, `incidents.view_incidents`, `incidents.report_events`, `incidents.view_statistics`\r\nEvent reporters  | `incidents.report_events`\r\nIncident viewers    | `incidents.view_incidents`\r\nStatistics and incident viewers | `incidents.view_incidents`, `incidents.view_statistics`\r\nStatistics only viewers     | `incidents.view_statistics`\r\n\r\n## FIR plugins\r\n\r\n### fir_nuggets\r\n\r\nAction  | Permission needed\r\n--------|--------------------\r\nCreate a nugget | `incidents.handle_incidents`\r\nEdit a nugget | `incidents.handle_incidents`\r\nDelete a nugget | `incidents.handle_incidents`\r\nView incident nuggets | `incidents.view_incidents`\r\n\r\n### fir_artifacts\r\n\r\nAction  | Permission needed\r\n--------|--------------------\r\nAdd an artifact | `incidents.view_incidents` (via a comment if `INCIDENT_VIEWER_CAN_COMMENT` is True), or `incidents.report_events` (event creation), or `incidents.handle_incidents` (creation or edition)\r\nDetach an artifact | `incidents.handle_incidents`\r\nView correlation list | User will only see correlated incidents with `incidents.view_incidents` permission\r\nAdd a file |  `incidents.handle_incidents`\r\nRemove a file |  `incidents.handle_incidents`\r\nView a file | `incidents.view_incidents`\r\nDownload a file | `incidents.view_incidents`\r\nDownload archive | `incidents.view_incidents`\r\n\r\n### fir_todos\r\n\r\nAction  | Permission needed\r\n--------|--------------------\r\nAdd an item | `incidents.handle_incidents` on the incident\r\nToggle an item state | `incidents.handle_incidents` on the incident or `incidents.view_incidents` on the item `business_line`\r\nDelete an item | `incidents.handle_incidents` on the incident\r\nView todo items | `incidents.view_incidents` on the incident\r\n\r\nThe dashboard shows every open items attached to the incidents the user can view.\r\n\r\n### fir_api\r\n\r\nThe user must have `incidents.handle_incidents` globally to access the API.\r\n\r\n### fir_alerting\r\n\r\nAction  | Permission needed\r\n--------|--------------------\r\nSend `alerting`email | `incidents.handle_incidents`  on the alerted business line\r\nSend `takedown` email | `incidents.handle_incidents` on the incident\r\n"},"comment":{"url":"https://api.github.com/repos/certsocietegenerale/FIR/issues/comments/246950857","html_url":"https://github.com/certsocietegenerale/FIR/pull/127#issuecomment-246950857","issue_url":"https://api.github.com/repos/certsocietegenerale/FIR/issues/127","id":246950857,"user":{"login":"gaelmuller","id":35897,"avatar_url":"https://avatars.githubusercontent.com/u/35897?v=3","gravatar_id":"","url":"https://api.github.com/users/gaelmuller","html_url":"https://github.com/gaelmuller","followers_url":"https://api.github.com/users/gaelmuller/followers","following_url":"https://api.github.com/users/gaelmuller/following{/other_user}","gists_url":"https://api.github.com/users/gaelmuller/gists{/gist_id}","starred_url":"https://api.github.com/users/gaelmuller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gaelmuller/subscriptions","organizations_url":"https://api.github.com/users/gaelmuller/orgs","repos_url":"https://api.github.com/users/gaelmuller/repos","events_url":"https://api.github.com/users/gaelmuller/events{/privacy}","received_events_url":"https://api.github.com/users/gaelmuller/received_events","type":"User","site_admin":false},"created_at":"2016-09-14T09:04:35Z","updated_at":"2016-09-14T09:04:35Z","body":"Thank you for your contribution, this looks good and this feature was definitely on top of the todo list.\r\n\r\nWe will try to review it faster than your last contribution 😄 "}}
{"actor":{"display_login":"gaelmuller"}}