{"action":"created","issue":{"url":"https://api.github.com/repos/ably/docs/issues/147","repository_url":"https://api.github.com/repos/ably/docs","labels_url":"https://api.github.com/repos/ably/docs/issues/147/labels{/name}","comments_url":"https://api.github.com/repos/ably/docs/issues/147/comments","events_url":"https://api.github.com/repos/ably/docs/issues/147/events","html_url":"https://github.com/ably/docs/issues/147","id":172313141,"number":147,"title":"need support article on how to emulate pusher-style mutable auth using token reauth and authCallback","user":{"login":"SimonWoolf","id":5908687,"avatar_url":"https://avatars.githubusercontent.com/u/5908687?v=3","gravatar_id":"","url":"https://api.github.com/users/SimonWoolf","html_url":"https://github.com/SimonWoolf","followers_url":"https://api.github.com/users/SimonWoolf/followers","following_url":"https://api.github.com/users/SimonWoolf/following{/other_user}","gists_url":"https://api.github.com/users/SimonWoolf/gists{/gist_id}","starred_url":"https://api.github.com/users/SimonWoolf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SimonWoolf/subscriptions","organizations_url":"https://api.github.com/users/SimonWoolf/orgs","repos_url":"https://api.github.com/users/SimonWoolf/repos","events_url":"https://api.github.com/users/SimonWoolf/events{/privacy}","received_events_url":"https://api.github.com/users/SimonWoolf/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ably/docs/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2016-08-21T09:37:56Z","updated_at":"2016-08-22T19:08:54Z","closed_at":null,"body":""},"comment":{"url":"https://api.github.com/repos/ably/docs/issues/comments/241517464","html_url":"https://github.com/ably/docs/issues/147#issuecomment-241517464","issue_url":"https://api.github.com/repos/ably/docs/issues/147","id":241517464,"user":{"login":"mattheworiordan","id":43789,"avatar_url":"https://avatars.githubusercontent.com/u/43789?v=3","gravatar_id":"","url":"https://api.github.com/users/mattheworiordan","html_url":"https://github.com/mattheworiordan","followers_url":"https://api.github.com/users/mattheworiordan/followers","following_url":"https://api.github.com/users/mattheworiordan/following{/other_user}","gists_url":"https://api.github.com/users/mattheworiordan/gists{/gist_id}","starred_url":"https://api.github.com/users/mattheworiordan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattheworiordan/subscriptions","organizations_url":"https://api.github.com/users/mattheworiordan/orgs","repos_url":"https://api.github.com/users/mattheworiordan/repos","events_url":"https://api.github.com/users/mattheworiordan/events{/privacy}","received_events_url":"https://api.github.com/users/mattheworiordan/received_events","type":"User","site_admin":false},"created_at":"2016-08-22T19:08:54Z","updated_at":"2016-08-22T19:08:54Z","body":">  then the capabilities are added together\r\n\r\nRight, so if I issue token request A to a user which gives them access to \"foo\" and \"bar\" channels, and then later issue them with token request B which gives them access only to \"foo\", in our current model I can be sure that the user, once they have used token B issued from token request B, will no longer have access to \"bar\".\r\n\r\nHowever, from what I understand you are proposing, the client can now arbitrarily include token A in their token request with B and now still have access to \"bar\"?  That is a problem AFAIC because the issuer, not the client, should be deciding on permissions and if necessary merging capabilities, not Ably."}}
{"actor":{"display_login":"mattheworiordan"}}