Skip to content

Consolidate WopiUserPermissions, Container permissions and Permission object #202

@dviry

Description

@dviry

Currently the IWopiSecurityHandler defines this method (only used when building CheckFileInfo):

Task<WopiUserPermissions> GetUserPermissions(ClaimsPrincipal principal, IWopiFile file, CancellationToken cancellationToken = default);

Yet when building CheckContainerInfo we (I) used the "new" attribute-based security which actually uses this method:

Task<bool> IsAuthorized(ClaimsPrincipal principal, IWopiAuthorizationRequirement requirement, CancellationToken cancellationToken = default);

Consolidation options:

  1. we rename WopiUserPermissions to WopiFilePermissions and create a parallel WopiContainerPermissions and the appropriat GetContainerPermissions() method in IWopiSecurityHandler; we leave the current Permissions as basic rights only for the attribute-security (since WopiContainerPermission has e.g. no Read right)
  2. we let the OnCheckFileInfo/OnCheckContainerInfo event handlers worry about that - in that case we wont need any WopiUserPermissions nor methods in IWopiSecurityHandler and keep the basic Permission object and current checks (which are handled anyway by IWopiSecurityHandler.IsAuthorized)
  3. combining all in one Permissions object might be confusing so I would not do that

I am personally voting for number 1 - clear, concise and separate - unless you have any other suggestions...

@petrsvihlik What do you think?

Metadata

Metadata

Assignees

Labels

triageScreening required.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions