You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/architecture/technical-details-of-permission-for-user-fields.md
+22-22
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
### Terminology:
2
2
3
-
- user row: a user row refers to a row being updated. Row is redundant but included to
3
+
- user row: a user row refers to a row being updated. Row is redundant but included to
4
4
help distinguish between row and field level security.
5
5
- team mate: a user assigned through UserPermission to the same project as another user
6
6
- any team member: a user assigned to a project through UserPermission
@@ -11,14 +11,14 @@
11
11
12
12
### Source of Privileges
13
13
14
-
Field level security specifics are derived from u[cru.py](../../app/core/cru_permissions.py). The file includes several lists that
15
-
you can use to derive different privileges. Search for these terms
14
+
Field level security specifics are derived from u[cru.py](../../app/core/cru_permissions.py). The file includes several lists that
15
+
you can use to derive different privileges. Search for these terms
16
16
17
17
-`_cru_permissions[profile_value]`
18
18
-`_cru_permissions[member_project]`
19
19
-`_cru_permissions[practice_lead_project]`
20
20
-`_cru_permissions[admin_global]`
21
-
fields followed by CRU or a subset of CRU for Create/Read/Update. Example:
21
+
fields followed by CRU or a subset of CRU for Create/Read/Update. Example:
22
22
`first_name:["RU"]` for a list would indicate that first name is readable and updateable
23
23
for the list.
24
24
@@ -40,15 +40,15 @@ The following API endpoints retrieve users:
40
40
41
41
- /user end point:
42
42
- Global admins can read, update, and create fields specified in
43
-
[cru.py](../../app/core/cru.py). Search for
43
+
[cru.py](../../app/core/cru.py). Search for
44
44
`_user_permissions[admin_global]`).
45
45
46
46
- Project admins can read and update fields specified in
47
47
[cru.py](../../app/core/cru.py) for other project leads.\
48
48
Search for for `_user_permissions[admin_project]` in [cru.py](../../app/core/cru.py)
49
49
50
50
- Practice area leads can read and update fields specified in
51
-
[cru.py](../../app/core/cru.py) for fellow team members. If
51
+
[cru.py](../../app/core/cru.py) for fellow team members. If
52
52
the team member is in the same practice area,\
53
53
Search for for `_user_permissions[practice_lead_project]` in [cru.py](../../app/core/cru.py)
54
54
@@ -66,7 +66,7 @@ The following API endpoints retrieve users:
66
66
67
67
#### /me endpoint functionality
68
68
69
-
Used for reading and updating information about the user that is logged in. User permission assignments do not apply.
69
+
Used for reading and updating information about the user that is logged in. User permission assignments do not apply.
70
70
71
71
- Row Level Security: Logged in user can always read and update their own information.
72
72
- Field Level Security: For read and update permissions, see `_cru_permissions[profile_value]` in [cru.py](../../app/core/cru.py).
@@ -79,7 +79,7 @@ This is covered by issue #394.
79
79
80
80
##### Field level specifics / cru.py
81
81
82
-
The implemented field level security specifics can be derived from [cru.py](../../app/core/cru.py) and should match the requirements. If field privileges change or the requirements
82
+
The implemented field level security specifics can be derived from [cru.py](../../app/core/cru.py) and should match the requirements. If field privileges change or the requirements
83
83
don't match what is implemented this can be fixed by changing [cru.py](../../app/core/cru.py).
84
84
85
85
##### /user endpoint technical implementation
@@ -88,41 +88,41 @@ don't match what is implemented this can be fixed by changing [cru.py](../../app
88
88
**serializers.py, permission_check.py**
89
89
- get (read)
90
90
- /user - see above bullet about response fields.
91
-
- /user/<uuid> fetches a specific user. See above bullet about response fields. If the requesting_user does not have permission
91
+
- /user/<uuid> fetches a specific user. See above bullet about response fields. If the requesting_user does not have permission
92
92
to view the user, PermisssionUtil.get_user_read_fields will find no fields to serialize and throw a ValidationError
validate_user_fields_patchable(requesting_user, response_related_user, request_fields)\` will compare request fields
95
-
against `cru.user_post_fields[admin_global]` which is derived from `_cru_permissions`. If the request fields
95
+
against `cru.user_post_fields[admin_global]` which is derived from `_cru_permissions`. If the request fields
96
96
include a field outside the requesting_user's scope, the method returns a PermissionError, otherwise the
97
-
record is udated. **views.py, permission_check.py**
97
+
record is udated. **views.py, permission_check.py**
98
98
- post (create): UserViewSet.create: If the requesting_user is not a global admin, the create method
99
99
will throw an error. Calls UserValidation.validate_user_fields_postable which compares
100
100
pe **views.py**
101
101
102
102
##### /me end point technical implementation
103
103
104
104
- response fields for get and patch: `UserProfileAPISerializer.to_representation` => `UserValidation.get_user_read_fields` determines which fields are serialized.
105
-
- get: see response fields above. No request fields accepted.**views.py, serializer.py**
105
+
- get: see response fields above. No request fields accepted. **views.py, serializer.py**
106
106
- patch (update): By default, calls super().update_partial of UserProfileAPIView for
107
-
the requesting user to update themselves. **views.py, serializer.py**
108
-
- post (create): not applicable. Prevented by setting http_method_names in
109
-
UserProfileAPIView to \["patch", "get"\]
107
+
the requesting user to update themselves. **views.py, serializer.py**
108
+
- post (create): not applicable. Prevented by setting http_method_names in
109
+
UserProfileAPIView to ["patch", "get"]
110
110
111
111
#### Supporting Files
112
112
113
-
Documentation is generated by pydoc package. pydoc reads comments between triple quotes. See Appendix A.
113
+
Documentation is generated by pydoc package. pydoc reads comments between triple quotes. See Appendix A.
-[permission_fields.py](./docs/pydoc/http_method_field_permissions.html) => called from permission_check to
117
-
determine permissiable fields. permission_fields.py derives permissable fields from
117
+
determine permissiable fields. permission_fields.py derives permissable fields from
118
118
user_permission_fields.
119
119
- user_permission_fields_constants.py => see permission_fields.py
120
120
- constants.py => holds constants for permission types.
121
121
- urls.py
122
122
123
123
### Test Technical Details
124
124
125
-
Details of the purpose of each test and supporting code can be found in the the docs/pydoc documentation. Additional methods are automatically called based on the name
125
+
Details of the purpose of each test and supporting code can be found in the the docs/pydoc documentation. Additional methods are automatically called based on the name
126
126
of the method.
127
127
128
128
### Appendix A - Generate pydoc Documentation
@@ -132,20 +132,20 @@ of the method.
132
132
pydoc documentation are located between triple quotes.
133
133
134
134
- See https://realpython.com/documenting-python-code/#docstring-types for format for creating class, method,
135
-
or module pydoc. For documenting specific variables, you can do this as part of the class, method,
135
+
or module pydoc. For documenting specific variables, you can do this as part of the class, method,
136
136
or module documentation.
137
137
- Check the file is included in documentation.py
138
138
- After making the change, generate as explained below.
139
139
140
140
#### Modifying pydoc Documentation
141
141
142
-
Look for documentation between triple quotes. Modify the documentation, then generate as explained
142
+
Look for documentation between triple quotes. Modify the documentation, then generate as explained
143
143
below.
144
144
145
145
#### Generating pydoc Documentation
146
146
147
-
From Docker screen, locate web container. Select option to open terminal. To run locally, open local
148
-
terminal. From terminal:
147
+
From Docker screen, locate web container. Select option to open terminal. To run locally, open local
Copy file name to clipboardExpand all lines: docs/contributing/howto/implement-user-based-security.md
+6-6
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
-**one-to-many user-related data access policy:** policy for tables where each row in the table is related to one and only one user, directly or indirectly.
4
4
-**authorization data access policy:** policy that requires authorization for create, update, delete and optionally read access.
5
-
-**other data access policy:** any custom policy not covered by the previous two polices. For example, data access policy for create, update, and delete could be based on Djano roles. In that scenario, a specific table might only be updateable by a user with a specific Django role.
5
+
-**other data access policy:** any custom policy not covered by the previous two polices. For example, data access policy for create, update, and delete could be based on Djano roles. In that scenario, a specific table might only be updateable by a user with a specific Django role.
6
6
7
7
## One-to-many user related data policy
8
8
@@ -30,7 +30,7 @@ A table that requires a user related data policy must have "user" as a field tha
30
30
31
31
### Record security
32
32
33
-
- determines whether a specific record can be viewed, updated, or created. If the table requires field level security then implementing record level security is not required.
33
+
- determines whether a specific record can be viewed, updated, or created. If the table requires field level security then implementing record level security is not required.
34
34
- implementation:
35
35
- modify views.py
36
36
- find `<table>ViewSet`
@@ -64,7 +64,7 @@ A table that requires a user related data policy must have "user" as a field tha
64
64
65
65
## Authorization data access policy
66
66
67
-
For many tables, create, update, and delete for all rows in the table are allowed if the request is from an authenticated user. Ability to read all rows may or may not require authentication. To implement one of these
67
+
For many tables, create, update, and delete for all rows in the table are allowed if the request is from an authenticated user. Ability to read all rows may or may not require authentication. To implement one of these
68
68
options modify view.py:
69
69
70
70
- find `<table>ViewSet`
@@ -92,15 +92,15 @@ The following API endpoints retrieve users:
92
92
93
93
- /user end point:
94
94
- Global admins can read, update, and create fields specified in
95
-
[cru.py](../../app/core/cru.py). Search for
95
+
[cru.py](../../app/core/cru.py). Search for
96
96
`_user_permissions[admin_global]`).
97
97
98
98
- Project admins can read and update fields specified in
99
99
[cru.py](../../app/core/cru.py) for other project leads.\
100
100
Search for for `_user_permissions[admin_project]` in [cru.py](../../app/core/cru.py)
101
101
102
102
- Practice area leads can read and update fields specified in
103
-
[cru.py](../../app/core/cru.py) for fellow team members. If
103
+
[cru.py](../../app/core/cru.py) for fellow team members. If
104
104
the team member is in the same practice area,\
105
105
Search for for `_user_permissions[practice_lead_project]` in [cru.py](../../app/core/cru.py)
106
106
@@ -118,7 +118,7 @@ The following API endpoints retrieve users:
118
118
119
119
#### /me endpoint functionality
120
120
121
-
Used for reading and updating information about the user that is logged in. User permission assignments do not apply.
121
+
Used for reading and updating information about the user that is logged in. User permission assignments do not apply.
122
122
123
123
- Row Level Security: Logged in user can always read and update their own information.
124
124
- Field Level Security: For read and update permissions, see `_cru_permissions[profile_value]` in [cru.py](../../app/core/cru.py).
0 commit comments