{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/wot-scripting-api/issues/91","repository_url":"https://api.github.com/repos/w3c/wot-scripting-api","labels_url":"https://api.github.com/repos/w3c/wot-scripting-api/issues/91/labels{/name}","comments_url":"https://api.github.com/repos/w3c/wot-scripting-api/issues/91/comments","events_url":"https://api.github.com/repos/w3c/wot-scripting-api/issues/91/events","html_url":"https://github.com/w3c/wot-scripting-api/issues/91","id":297379627,"number":91,"title":"Security, WoT Scripting API: security metadata in API","user":{"login":"ereshetova","id":1013701,"avatar_url":"https://avatars1.githubusercontent.com/u/1013701?v=4","gravatar_id":"","url":"https://api.github.com/users/ereshetova","html_url":"https://github.com/ereshetova","followers_url":"https://api.github.com/users/ereshetova/followers","following_url":"https://api.github.com/users/ereshetova/following{/other_user}","gists_url":"https://api.github.com/users/ereshetova/gists{/gist_id}","starred_url":"https://api.github.com/users/ereshetova/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ereshetova/subscriptions","organizations_url":"https://api.github.com/users/ereshetova/orgs","repos_url":"https://api.github.com/users/ereshetova/repos","events_url":"https://api.github.com/users/ereshetova/events{/privacy}","received_events_url":"https://api.github.com/users/ereshetova/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-15T09:35:52Z","updated_at":"2018-02-15T09:36:13Z","closed_at":null,"author_association":"NONE","body":"Some WoT Scripting API methods need to have a way to provide security-related parameters for these security-related use cases:\r\n\r\n1. On server side defining access control for actions & properties: When building a new (or updating) ThingDescription object and ExposedThing, there has to be a way for a script to specify security-related information that client would need to have in order to be authorized to do certain action or access a property for reading or writing (calling the invokeAction(), the writeProperty() and the readProperty() methods). \r\n\r\n2. On server side defining access control for notifications & Object Changes: When building a new (or updating) ThingDescription object and ExposedThing, there has to be a way for a script to specify security-related information that client would need to have in order to be authorized to subscribe to various events on Thing, property change or TD change (being able to get callbacks from the onEvent(), the onPropertyChange(), and the onTDChange() methods)\r\n\r\n3. On client side providing security-metadata for above two cases: after the client reads the TD and knows what credentials it needs to invoke certain method or subscribe for certain info, it goes and obtains the required credentials (if doesn't have), and then it needs to be able to supply them somehow to the server. It might be supplying an authorization token or certificate or anything else, but the information needs to be delivered.  For example, when invoking writeProperty() or onEvent() methods. "},"comment":{"url":"https://api.github.com/repos/w3c/wot-scripting-api/issues/comments/365872549","html_url":"https://github.com/w3c/wot-scripting-api/issues/91#issuecomment-365872549","issue_url":"https://api.github.com/repos/w3c/wot-scripting-api/issues/91","id":365872549,"user":{"login":"ereshetova","id":1013701,"avatar_url":"https://avatars1.githubusercontent.com/u/1013701?v=4","gravatar_id":"","url":"https://api.github.com/users/ereshetova","html_url":"https://github.com/ereshetova","followers_url":"https://api.github.com/users/ereshetova/followers","following_url":"https://api.github.com/users/ereshetova/following{/other_user}","gists_url":"https://api.github.com/users/ereshetova/gists{/gist_id}","starred_url":"https://api.github.com/users/ereshetova/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ereshetova/subscriptions","organizations_url":"https://api.github.com/users/ereshetova/orgs","repos_url":"https://api.github.com/users/ereshetova/repos","events_url":"https://api.github.com/users/ereshetova/events{/privacy}","received_events_url":"https://api.github.com/users/ereshetova/received_events","type":"User","site_admin":false},"created_at":"2018-02-15T09:36:13Z","updated_at":"2018-02-15T09:36:13Z","author_association":"NONE","body":"For your review: @zolkis, @mmccool "}}
{"actor":{"display_login":"ereshetova"}}