{"action":"closed","issue":{"url":"https://api.github.com/repos/nasa/utm-apis/issues/40","repository_url":"https://api.github.com/repos/nasa/utm-apis","labels_url":"https://api.github.com/repos/nasa/utm-apis/issues/40/labels{/name}","comments_url":"https://api.github.com/repos/nasa/utm-apis/issues/40/comments","events_url":"https://api.github.com/repos/nasa/utm-apis/issues/40/events","html_url":"https://github.com/nasa/utm-apis/issues/40","id":330313993,"node_id":"MDU6SXNzdWUzMzAzMTM5OTM=","number":40,"title":"Document requirement to only allow announcement/mod of your ops data","user":{"login":"nasajoey","id":22481570,"node_id":"MDQ6VXNlcjIyNDgxNTcw","avatar_url":"https://avatars1.githubusercontent.com/u/22481570?v=4","gravatar_id":"","url":"https://api.github.com/users/nasajoey","html_url":"https://github.com/nasajoey","followers_url":"https://api.github.com/users/nasajoey/followers","following_url":"https://api.github.com/users/nasajoey/following{/other_user}","gists_url":"https://api.github.com/users/nasajoey/gists{/gist_id}","starred_url":"https://api.github.com/users/nasajoey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nasajoey/subscriptions","organizations_url":"https://api.github.com/users/nasajoey/orgs","repos_url":"https://api.github.com/users/nasajoey/repos","events_url":"https://api.github.com/users/nasajoey/events{/privacy}","received_events_url":"https://api.github.com/users/nasajoey/received_events","type":"User","site_admin":false},"labels":[{"id":957778249,"node_id":"MDU6TGFiZWw5NTc3NzgyNDk=","url":"https://api.github.com/repos/nasa/utm-apis/labels/Security","name":"Security","color":"b60205","default":false},{"id":888978051,"node_id":"MDU6TGFiZWw4ODg5NzgwNTE=","url":"https://api.github.com/repos/nasa/utm-apis/labels/TCL4","name":"TCL4","color":"5af4a7","default":false}],"state":"closed","locked":false,"assignee":{"login":"nasajoey","id":22481570,"node_id":"MDQ6VXNlcjIyNDgxNTcw","avatar_url":"https://avatars1.githubusercontent.com/u/22481570?v=4","gravatar_id":"","url":"https://api.github.com/users/nasajoey","html_url":"https://github.com/nasajoey","followers_url":"https://api.github.com/users/nasajoey/followers","following_url":"https://api.github.com/users/nasajoey/following{/other_user}","gists_url":"https://api.github.com/users/nasajoey/gists{/gist_id}","starred_url":"https://api.github.com/users/nasajoey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nasajoey/subscriptions","organizations_url":"https://api.github.com/users/nasajoey/orgs","repos_url":"https://api.github.com/users/nasajoey/repos","events_url":"https://api.github.com/users/nasajoey/events{/privacy}","received_events_url":"https://api.github.com/users/nasajoey/received_events","type":"User","site_admin":false},"assignees":[{"login":"nasajoey","id":22481570,"node_id":"MDQ6VXNlcjIyNDgxNTcw","avatar_url":"https://avatars1.githubusercontent.com/u/22481570?v=4","gravatar_id":"","url":"https://api.github.com/users/nasajoey","html_url":"https://github.com/nasajoey","followers_url":"https://api.github.com/users/nasajoey/followers","following_url":"https://api.github.com/users/nasajoey/following{/other_user}","gists_url":"https://api.github.com/users/nasajoey/gists{/gist_id}","starred_url":"https://api.github.com/users/nasajoey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nasajoey/subscriptions","organizations_url":"https://api.github.com/users/nasajoey/orgs","repos_url":"https://api.github.com/users/nasajoey/repos","events_url":"https://api.github.com/users/nasajoey/events{/privacy}","received_events_url":"https://api.github.com/users/nasajoey/received_events","type":"User","site_admin":false}],"milestone":null,"comments":2,"created_at":"2018-06-07T15:03:43Z","updated_at":"2018-11-20T16:12:42Z","closed_at":"2018-11-20T16:12:42Z","author_association":"MEMBER","body":"Currently, there is not explicit documentation on restricting USSs to only update their own operational data.  For example:\r\n\r\n1. USS_1 gets a valid access_token to communicate operation data with other USSs.\r\n2. USS_1 gets a data for operation_alpha from USS_2.\r\n3. USS_1 uses access_token and information known about operation_alpha data to submit updates (including messages and positions) to other USSs about operation_alpha.\r\n\r\nWe need a requirement that links the data in the access_token to the operation data (including Operations, Positions, UTMMessages, etc).  This check must be made for all relevant data exchanges.\r\n\r\nThe current plan is to use the 'uss_name' field in Operation, Position, and various message schemas.  This will need to be matched against the 'sub' field in the access_token.  If no match, the receiver should throw a 403 (we can discuss if this should be a 401 or 403).\r\n\r\nTo truly formalize, will need an additional business logic check that if the resource was already known to the receiver that the uss_name has not changed from the previous data exchange.  For example if USS_A sent me operation_1 earlier, then later USS_B tries to send an update to operation_1 and has altered the uss_name field to match USS_B's access_token, the check described above would pass, but this transaction should not be allowed (USS_B is trying to alter USS_A's operation data, USS_B is a jerk).  In this case, 403 is also probably appropriate response.\r\n\r\nComments appreciated."}}
{"actor":{"display_login":"nasajoey"}}