{"action":"closed","issue":{"url":"https://api.github.com/repos/thaliproject/salti/issues/3","repository_url":"https://api.github.com/repos/thaliproject/salti","labels_url":"https://api.github.com/repos/thaliproject/salti/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/thaliproject/salti/issues/3/comments","events_url":"https://api.github.com/repos/thaliproject/salti/issues/3/events","html_url":"https://github.com/thaliproject/salti/issues/3","id":138545920,"number":3,"title":"Flip the ACL structure from path.role.verb to role.path.verb","user":{"login":"yaronyg","id":1480964,"avatar_url":"https://avatars.githubusercontent.com/u/1480964?v=3","gravatar_id":"","url":"https://api.github.com/users/yaronyg","html_url":"https://github.com/yaronyg","followers_url":"https://api.github.com/users/yaronyg/followers","following_url":"https://api.github.com/users/yaronyg/following{/other_user}","gists_url":"https://api.github.com/users/yaronyg/gists{/gist_id}","starred_url":"https://api.github.com/users/yaronyg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yaronyg/subscriptions","organizations_url":"https://api.github.com/users/yaronyg/orgs","repos_url":"https://api.github.com/users/yaronyg/repos","events_url":"https://api.github.com/users/yaronyg/events{/privacy}","received_events_url":"https://api.github.com/users/yaronyg/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/thaliproject/salti/labels/4%20-%20Done","name":"4 - Done","color":"CCCCCC"},{"url":"https://api.github.com/repos/thaliproject/salti/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":{"login":"cicorias","id":1080406,"avatar_url":"https://avatars.githubusercontent.com/u/1080406?v=3","gravatar_id":"","url":"https://api.github.com/users/cicorias","html_url":"https://github.com/cicorias","followers_url":"https://api.github.com/users/cicorias/followers","following_url":"https://api.github.com/users/cicorias/following{/other_user}","gists_url":"https://api.github.com/users/cicorias/gists{/gist_id}","starred_url":"https://api.github.com/users/cicorias/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cicorias/subscriptions","organizations_url":"https://api.github.com/users/cicorias/orgs","repos_url":"https://api.github.com/users/cicorias/repos","events_url":"https://api.github.com/users/cicorias/events{/privacy}","received_events_url":"https://api.github.com/users/cicorias/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/thaliproject/salti/milestones/1","html_url":"https://github.com/thaliproject/salti/milestones/New%20Infra","labels_url":"https://api.github.com/repos/thaliproject/salti/milestones/1/labels","id":1618459,"number":1,"title":"New Infra","description":"","creator":{"login":"yaronyg","id":1480964,"avatar_url":"https://avatars.githubusercontent.com/u/1480964?v=3","gravatar_id":"","url":"https://api.github.com/users/yaronyg","html_url":"https://github.com/yaronyg","followers_url":"https://api.github.com/users/yaronyg/followers","following_url":"https://api.github.com/users/yaronyg/following{/other_user}","gists_url":"https://api.github.com/users/yaronyg/gists{/gist_id}","starred_url":"https://api.github.com/users/yaronyg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yaronyg/subscriptions","organizations_url":"https://api.github.com/users/yaronyg/orgs","repos_url":"https://api.github.com/users/yaronyg/repos","events_url":"https://api.github.com/users/yaronyg/events{/privacy}","received_events_url":"https://api.github.com/users/yaronyg/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":1,"state":"open","created_at":"2016-03-02T18:18:08Z","updated_at":"2016-04-07T00:37:58Z","due_on":"2016-03-31T07:00:00Z","closed_at":null},"comments":0,"created_at":"2016-03-04T18:18:37Z","updated_at":"2016-04-07T00:37:58Z","closed_at":"2016-04-07T00:37:58Z","body":"The current structure is sub-optimal for our needs for two reasons. First, it requires mixing acls together. In other words if I want to define role 1 and role 2 we have to define one acl with both roles in it defined together.\r\n\r\n```JSON\r\n{\r\n  \"path\" : \"/\",\r\n   \"roles\" : [\r\n      { \"role\": \"admin\", \"verbs\": [\"GET\", \"PUT\"] },\r\n      { \"role\": \"user\", \"verbs\": [\"GET\"] }\r\n   ]\r\n}, {\r\n  \"path\": \"/foo\",\r\n  \"roles\" : [\r\n      { \"role\": \"admin\", \"verbs\": [\"GET\", \"DELETE\"] },\r\n      { \"role\": \"user\", \"verbs\": [\"GET\"] }\r\n   ]\r\n}\r\n```\r\n\r\nSo to understand what a particular role is doing we have to walk through each and every path and try to keep in our mind which role is which. It also means that people can't define roles separately and then bring them together. So if one was using different modules with different roles there is no way to just pull in the role. Instead one has to write code to parse it into a single ACL.\r\n\r\nSecond, the current structure is also inefficient in that we have a relatively small number of roles but a large number of paths. But by putting path at the top of the structure we are constantly forced to repeat the same roles over and over again.\r\n\r\nWhat we would rather have is:\r\n\r\n```JSON\r\n{\r\n  \"ACLs\": \r\n  {\r\n     \"admin\": {\r\n         \"/\": [\"GET\", \"PUT\"],\r\n         \"/foo\": [\"GET\", \"DELETE\"]\r\n      },\r\n      \"user\": {\r\n         \"/\": [\"GET\"],\r\n         \"/foo\": [\"GET\"]\r\n      }\r\n}\r\n```\r\n\r\nWith this structure all the paths and verbs for a role are expressed in a very compact format and we can have different modules define different roles and very easily bring them together into a single ACL that we enforce at run time.\r\n\r\n<!---\r\n@huboard:{\"order\":2.524354896707238e-29,\"milestone_order\":3.0,\"custom_state\":\"\"}\n-->\r\n"}}