goharbor/harbor

Permission Annotations in Swagger

Open

#21734 opened on Mar 13, 2025

View on GitHub
 (2 comments) (0 reactions) (0 assignees)Go (28,490 stars) (5,235 forks)batch import
backloghelp wantedkind/questionkind/requirement

Description

Is your feature request related to a problem? Please describe. I am trying to write scripts using the API v2.0 and a Robot account, but I keep getting 403 Forbidden responses.

Describe the solution you'd like It would be helpful if in the Swagger file, you could identify "Permissions required: System-wide Project/List, Project-level Project/Read"

Describe the main design/architecture of your solution

Image

Describe the development plan you've considered While this may introduce a mild security risk ("I have permission to do X, therefore, I could also do Y"), it may help developers to identify where additional permission controls should be placed.

Contributor guide

Tech stack
godockerkubernetesrest api
Domain
backendapidocumentation
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
familiarity with Swagger/OpenAPIGo language basicsunderstanding of Harbor API
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60
Research direction
Examine the existing Swagger/OpenAPI specification files in the repository, likely in the 'api' or 'swagger' directory. Look for how API endpoints are annotated with metadata. Check if there is a common pattern or existing annotations for permissions. Review any comments from maintainers on the issue to clarify the expected format and scope.