Associate API tokens with users for importer authorization

Aperta
  • Qualcosa non va?
#1,237 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
rails, ruby
Ambito
api, authentication, authorization

Direzione di ricerca

Start in Bulkrax::ImportersController and find the temporary API branches that call Importer.all or Importer.find without CanCan checks, plus the token-to-user TODOs. Then look at the Ability configuration to see how session requests are scoped. Done means a valid token resolves to a user whose CanCan rules govern index, DataTables and member actions, invalid tokens get 401 or 403, and request specs cover owner, non-owner, service-account and invalid-token cases.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Feature

Associate authenticated Bulkrax API tokens with a user and apply the existing CanCan importer authorization rules to API requests.

The importer ownership work currently preserves compatibility by bypassing per-user scoping for token-authenticated requests: a valid token can list all importers and access importer members without evaluating ownership. This is temporary until the token-to-user relationship is available.

Desired behavior

  1. Authenticate a Bulkrax API token and resolve it to a user exposed as current_user for the request.
  2. Apply the same CanCan rules used for session-authenticated importer requests to API collection and member actions.
  3. Return an appropriate authentication/authorization response (401 or 403) when a token is invalid or cannot be resolved to an authorized user.
  4. Support intentionally broad integration access through an explicit service-account Ability rule (for example, can :manage, Bulkrax::Importer) rather than an API-wide authorization bypass.

Implementation notes

  • Remove the temporary API branches in Bulkrax::ImportersController that use Importer.all or Importer.find without CanCan authorization once the authenticated user context is available.
  • Ensure API list, DataTables, and member actions all use the same scoped authorization path.
  • Preserve existing non-API behavior.
  • Coordinate with #1054, which investigates whether the Bulkrax JSON API is usable and documented; this issue addresses the authorization model required for secure user-scoped API access.

Acceptance criteria

  • A valid API token resolves to the intended user for the request.
  • API index and DataTables responses include only importers readable by that user.
  • API member actions deny access to importers the user cannot read/manage.
  • Invalid or unresolved tokens do not receive an unscoped importer response.
  • A service account can be deliberately granted broad importer access through Ability configuration.
  • Request/controller specs cover owner, non-owner, admin/service-account, and invalid/unresolved-token cases.
  • The temporary token-to-user TODOs in Bulkrax::ImportersController are removed or updated as part of the implementation.
Lingua principale
Ruby
Stelle
14
Fork
27
Merge medio
3g 4h
PR unite (30g)
23

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di samvera/bulkrax

Tutte le issue di samvera/bulkrax

Issue simili

Altre issue su Ruby

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.