{"action":"created","issue":{"url":"https://api.github.com/repos/StackStorm/st2/issues/4054","repository_url":"https://api.github.com/repos/StackStorm/st2","labels_url":"https://api.github.com/repos/StackStorm/st2/issues/4054/labels{/name}","comments_url":"https://api.github.com/repos/StackStorm/st2/issues/4054/comments","events_url":"https://api.github.com/repos/StackStorm/st2/issues/4054/events","html_url":"https://github.com/StackStorm/st2/pull/4054","id":309694786,"number":4054,"title":"[WIP] [RBAC] User resource permission isolation","user":{"login":"Kami","id":125088,"avatar_url":"https://avatars3.githubusercontent.com/u/125088?v=4","gravatar_id":"","url":"https://api.github.com/users/Kami","html_url":"https://github.com/Kami","followers_url":"https://api.github.com/users/Kami/followers","following_url":"https://api.github.com/users/Kami/following{/other_user}","gists_url":"https://api.github.com/users/Kami/gists{/gist_id}","starred_url":"https://api.github.com/users/Kami/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kami/subscriptions","organizations_url":"https://api.github.com/users/Kami/orgs","repos_url":"https://api.github.com/users/Kami/repos","events_url":"https://api.github.com/users/Kami/events{/privacy}","received_events_url":"https://api.github.com/users/Kami/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/StackStorm/st2/milestones/18","html_url":"https://github.com/StackStorm/st2/milestone/18","labels_url":"https://api.github.com/repos/StackStorm/st2/milestones/18/labels","id":3039252,"number":18,"title":"2.7.0","description":"","creator":{"login":"armab","id":1533818,"avatar_url":"https://avatars2.githubusercontent.com/u/1533818?v=4","gravatar_id":"","url":"https://api.github.com/users/armab","html_url":"https://github.com/armab","followers_url":"https://api.github.com/users/armab/followers","following_url":"https://api.github.com/users/armab/following{/other_user}","gists_url":"https://api.github.com/users/armab/gists{/gist_id}","starred_url":"https://api.github.com/users/armab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/armab/subscriptions","organizations_url":"https://api.github.com/users/armab/orgs","repos_url":"https://api.github.com/users/armab/repos","events_url":"https://api.github.com/users/armab/events{/privacy}","received_events_url":"https://api.github.com/users/armab/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":46,"state":"open","created_at":"2018-01-16T14:37:36Z","updated_at":"2018-03-29T13:18:43Z","due_on":null,"closed_at":null},"comments":4,"created_at":"2018-03-29T10:03:52Z","updated_at":"2018-03-30T13:18:33Z","closed_at":null,"author_association":"OWNER","pull_request":{"url":"https://api.github.com/repos/StackStorm/st2/pulls/4054","html_url":"https://github.com/StackStorm/st2/pull/4054","diff_url":"https://github.com/StackStorm/st2/pull/4054.diff","patch_url":"https://github.com/StackStorm/st2/pull/4054.patch"},"body":"This pull request works on top of a great start in #4013.\r\n\r\nThe goal is to get this PR finished in time for v2.7.0.\r\n\r\nIt includes the following changes (most of them come from comments on that PR):\r\n\r\n* [x] Skip permission isolation checks if RBAC is disabled\r\n* [x] Allow admin users to view all the resource when permission isolation is enabled\r\n* [x] Some code performance optimizations (perform check outside of the loop so it happens once instead of N times, etc.\r\n* [x] More and better test cases for all the scenarios (user is admin, user is system user, etc.)\r\n* [x] Implement resource isolation for rules API endpoint\r\n* [x] Decide on how to handle special system \"observer\" role\r\n* [ ] Implement resource isolation for get one API endpoints\r\n  * [x] Action Executions\r\n  * [ ] Rules \r\n* [ ] Documentation change\r\n\r\n## Open Questions\r\n\r\n### How to handle \"observer\" system role\r\n\r\nRight now we have a special \"observer\" system role. This role grants user \"view\" permission on all the resources.\r\n\r\nWe should decide how to tie this into permission isolation - should this role also grant ability to view resources for all the users (aka user with this role can overcome permission isolation - same as for the admin user)."},"comment":{"url":"https://api.github.com/repos/StackStorm/st2/issues/comments/377522326","html_url":"https://github.com/StackStorm/st2/pull/4054#issuecomment-377522326","issue_url":"https://api.github.com/repos/StackStorm/st2/issues/4054","id":377522326,"user":{"login":"Kami","id":125088,"avatar_url":"https://avatars3.githubusercontent.com/u/125088?v=4","gravatar_id":"","url":"https://api.github.com/users/Kami","html_url":"https://github.com/Kami","followers_url":"https://api.github.com/users/Kami/followers","following_url":"https://api.github.com/users/Kami/following{/other_user}","gists_url":"https://api.github.com/users/Kami/gists{/gist_id}","starred_url":"https://api.github.com/users/Kami/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kami/subscriptions","organizations_url":"https://api.github.com/users/Kami/orgs","repos_url":"https://api.github.com/users/Kami/repos","events_url":"https://api.github.com/users/Kami/events{/privacy}","received_events_url":"https://api.github.com/users/Kami/received_events","type":"User","site_admin":false},"created_at":"2018-03-30T13:18:32Z","updated_at":"2018-03-30T13:18:32Z","author_association":"OWNER","body":"Resource isolation for \"get one\" API endpoints is now also implemented - 83c54638a877e13b0c0c09165e40f61e55c42698, de24fc71d6c6b009416f628950cabbf1b0271191, 0af95302d620465544a490b00609a74c6fe4bf84, 7b24fb71e2abeff562303dceab3d67387c9c103e, 4623307f9cf0fc5888b9aa3ece855e2b5490c206.\r\n\r\nThe change took slightly longer than I would hope for, but it's a security sensitive code so we shouldn't rush it.\r\n\r\nI still need to implement isolation for rules (just tests) and do some more smaller changes (more loggic, etc.).\r\n\r\n/cc @apolloliu "}}
{"actor":{"display_login":"Kami"}}