{"action":"opened","issue":{"url":"https://api.github.com/repos/zero-os/0-robot/issues/209","repository_url":"https://api.github.com/repos/zero-os/0-robot","labels_url":"https://api.github.com/repos/zero-os/0-robot/issues/209/labels{/name}","comments_url":"https://api.github.com/repos/zero-os/0-robot/issues/209/comments","events_url":"https://api.github.com/repos/zero-os/0-robot/issues/209/events","html_url":"https://github.com/zero-os/0-robot/issues/209","id":325727108,"number":209,"title":"Improve authentication levels in REST API","user":{"login":"zaibon","id":303164,"avatar_url":"https://avatars2.githubusercontent.com/u/303164?v=4","gravatar_id":"","url":"https://api.github.com/users/zaibon","html_url":"https://github.com/zaibon","followers_url":"https://api.github.com/users/zaibon/followers","following_url":"https://api.github.com/users/zaibon/following{/other_user}","gists_url":"https://api.github.com/users/zaibon/gists{/gist_id}","starred_url":"https://api.github.com/users/zaibon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zaibon/subscriptions","organizations_url":"https://api.github.com/users/zaibon/orgs","repos_url":"https://api.github.com/users/zaibon/repos","events_url":"https://api.github.com/users/zaibon/events{/privacy}","received_events_url":"https://api.github.com/users/zaibon/received_events","type":"User","site_admin":false},"labels":[{"id":726490308,"url":"https://api.github.com/repos/zero-os/0-robot/labels/type_bug","name":"type_bug","color":"fef2c0","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/zero-os/0-robot/milestones/6","html_url":"https://github.com/zero-os/0-robot/milestone/6","labels_url":"https://api.github.com/repos/zero-os/0-robot/milestones/6/labels","id":3257916,"number":6,"title":"0.7.0","description":"ACL support using BCDB schema, users & groups","creator":{"login":"zaibon","id":303164,"avatar_url":"https://avatars2.githubusercontent.com/u/303164?v=4","gravatar_id":"","url":"https://api.github.com/users/zaibon","html_url":"https://github.com/zaibon","followers_url":"https://api.github.com/users/zaibon/followers","following_url":"https://api.github.com/users/zaibon/following{/other_user}","gists_url":"https://api.github.com/users/zaibon/gists{/gist_id}","starred_url":"https://api.github.com/users/zaibon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zaibon/subscriptions","organizations_url":"https://api.github.com/users/zaibon/orgs","repos_url":"https://api.github.com/users/zaibon/repos","events_url":"https://api.github.com/users/zaibon/events{/privacy}","received_events_url":"https://api.github.com/users/zaibon/received_events","type":"User","site_admin":false},"open_issues":10,"closed_issues":0,"state":"open","created_at":"2018-04-11T07:13:05Z","updated_at":"2018-05-23T14:17:15Z","due_on":"2018-05-31T07:00:00Z","closed_at":null},"comments":0,"created_at":"2018-05-23T14:17:15Z","updated_at":"2018-05-23T14:17:15Z","closed_at":null,"author_association":"MEMBER","body":"Currently there are 2 level of authentications which are documented at: https://github.com/zero-os/0-robot/blob/master/docs/security.md\r\n\r\nThis brings multiple issues:\r\n- in the case of the node robot, now since https://github.com/zero-os/0-robot/commit/76794cec5ca5fc1111c67f11672580d568bd728e the node robot automatically installed a node service on the robot to allow automatic registration of the node. This means the secret of this node service is own by no one. Not even the farmer that own the node. This is wrong cause the node service provide useful actions like `reboot`, `info`, .... Things that a farmer should be able to schedule\r\n- Sensitive API endpoint like `add_repo`, `checkout_repo` are not reserved for farmer access only. Which create a big security hole since any one could checkout template repo with custom code and gain access to the 0-OS "}}
{"actor":{"display_login":"zaibon"}}