|
| 1 | +# Datasets Authoorization |
| 2 | +## CASL ability actions |
| 3 | +This is the list of the permissions methods available for datasets and all their endpoints and more fine-grained instance authorization. |
| 4 | + |
| 5 | + |
| 6 | +### Endpoint authorization |
| 7 | +1. DatasetCreate |
| 8 | +2. DatasetRead |
| 9 | +- DatasetUpdate |
| 10 | +- DatasetDelete |
| 11 | +- DatasetAttachmentCreate |
| 12 | +- DatasetAttachmentRead |
| 13 | +- DatasetAttachmentUpdate |
| 14 | +- DatasetAttachmentDelete |
| 15 | +- DatasetOrigdatablockCreate |
| 16 | +- DatasetOrigdatablockRead |
| 17 | +- DatasetOrigdatablockUpdate |
| 18 | +- DatasetOrigdatablockDelete |
| 19 | +- DatasetDatablockCreate |
| 20 | +- DatasetDatablockRead |
| 21 | +- DatasetDatablockUpdate |
| 22 | +- DatasetDatablockDelete |
| 23 | +- DatasetLogbookRead |
| 24 | +### Instance authorization |
| 25 | +1. DatasetCreateOwnerNoPid |
| 26 | +2. DatasetCreateOwnerWithPid |
| 27 | +- DatasetCreateAny |
| 28 | +- DatasetReadManyPublic |
| 29 | +- DatasetReadManyAccess |
| 30 | +- DatasetReadManyOwner |
| 31 | +- DatasetReadOnePublic |
| 32 | +- DatasetReadOneAccess |
| 33 | +- DatasetReadOneOwner |
| 34 | +- DatasetReadAny |
| 35 | +- DatasetUpdateOwner |
| 36 | +- DatasetUpdateAny |
| 37 | +- DetasetDeleteOwner |
| 38 | +- DatasetDeleteAny |
| 39 | +- DatasetAttachmentCreateOwner |
| 40 | +- DatasetAttachmentCreateAny |
| 41 | +- DatasetAttachmentReadPublic |
| 42 | +- DatasetAttachmentReadAccess |
| 43 | +- DatasetAttachmentReadOwner |
| 44 | +- DatasetAttachmentReadAny |
| 45 | +- DatasetAtatchementUpdateOwner |
| 46 | +- DatasetAtatchementUpdateAny |
| 47 | +- DatasetAttachmentDeleteOwner |
| 48 | +- DatasetAttachmentDeleteAny |
| 49 | +- DatasetOrigdatablockCreateOwner |
| 50 | +- DatasetOrigdatablockCreateAny |
| 51 | +- DatasetOrigdatablockReadPublic |
| 52 | +- DatasetOrigdatablockReadAccess |
| 53 | +- DatasetOrigdatablockReadOwner |
| 54 | +- DatasetOrigdatablockReadAny |
| 55 | +- DatasetOrigdatablockUpdateOwner |
| 56 | +- DatasetOrigdatablockUpdateAny |
| 57 | +- DatasetOrigdatablockDeleteAny |
| 58 | +- DatasetDatablockCreateOwner |
| 59 | +- DatasetDatablockCreateAny |
| 60 | +- DatasetDatablockReadPublic |
| 61 | +- DatasetDatablockReadAccess |
| 62 | +- DatasetDatablockReadOwner |
| 63 | +- DatasetDatablockReadAny |
| 64 | +- DatasetDatablockUpdateOwner |
| 65 | +- DatasetDatablockUpdateAny |
| 66 | +- DatasetDatablockDeleteOwner |
| 67 | +- DatasetDatablockDeleteAny |
| 68 | +- DatasetLogbookReadOwner |
| 69 | +- DatasetLogbookReadAny |
| 70 | + |
| 71 | +### Implementation |
| 72 | +How the different level of authorization translates in data condition applied byt he backend. |
| 73 | + |
| 74 | +- **Public** |
| 75 | +- `isPublished = true` |
| 76 | +- **Access** (condition ar applied in logical _or_) |
| 77 | +- `isPublished = true` |
| 78 | +- `ownerGroup` is one of the groups that the user belongs |
| 79 | +- `accessGroups` are one of the groups that the user belongs |
| 80 | +- `sharedWith` contains the user's email |
| 81 | +- **Owner** |
| 82 | + - `ownerGroup` is one of the groups that the user belongs |
| 83 | +- **Any** |
| 84 | +- User can perform the action to any dataset |
| 85 | + |
| 86 | + |
| 87 | +### Priority |
| 88 | +``` |
| 89 | + DatasetCreate-->DatasetCreateOwnerNoPid; |
| 90 | + DatasetCreateOwnerNoPid-->DatasetCreateOwnerWithPid; |
| 91 | + DatasetCreateOwnerWithPid-->DatasetCreateAny; |
| 92 | +``` |
| 93 | +``` |
| 94 | + DatasetRead-->DatasetReadManyPublic; |
| 95 | + DatasetReadManyPublic-->DatasetReadManyAccess; |
| 96 | + DatasetReadManyAccess-->DatasetReadManyOwner; |
| 97 | + DatasetReadManyOwner-->DatasetReadAny; |
| 98 | + DatasetRead-->DatasetReadOnePublic; |
| 99 | + DatasetReadOnePublic-->DatasetReadOneAccess; |
| 100 | + DatasetReadOneAccess-->DatasetReadOneOwner; |
| 101 | + DatasetReadOneOwner-->DatasetReadAny; |
| 102 | +``` |
| 103 | +``` |
| 104 | + DatasetUpdate-->DatasetUpdateOwner; |
| 105 | + DatasetUpdateOwner-->DatasetUpdateAny; |
| 106 | + DatasetDelete-->DatasetDeleteOwner; |
| 107 | + DatasetDeleteOwner-->DatasetDeleteAny; |
| 108 | +``` |
| 109 | + |
| 110 | +### Authorization table |
| 111 | +Note, merely for visibility reasons the table has been split. Hierarchically, `OrigDatablocks` and `Datablocks` belong to `Datasets`. |
| 112 | +#### Datasets |
| 113 | +| HTTP method | Endpoint | Endpoint Authorization | Anonymous | Authenticated User | Create Dataset Groups | Create Dataset with Pid Groups | Create Dataset Privileged Groups | Admin Groups | Delete Groups | Notes | |
| 114 | +| -------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | |
| 115 | +| POST | Datasets | _DatasetCreate_ | __no__ | __no__ | Owner, w/o PID<br/>_DatasetCreateOwnerNoPid_ | Owner, w/ PID<br/>_DatasetCreateOwnerWithPid_ | Any<br/>_DatasetCreateAny_ | Any<br/>_DatasetCreateAny_ | __no__ | |
| 116 | +| POST | Datasets/isValid | _DatasetCreate_ | __no__ | __no__ | Owner, w/o PID<br/>_DatasetCreateOwnerNoPid_ | Owner, W/ PID<br/>_DatasetCreateOwnerWithPid_ | Any<br/>_DatasetCreateAny_ | Any<br/>_DatasetCreateAny_ | __no__ | |
| 117 | +| GET | Datasets | _DatasetRead_ | Public<br/>_DatasetReadPublic_ | Has Access<br/>_DatasetReadAccess_ | Has Access<br/>_DatasetReadAccess_ | Has Access<br/>_DatasetReadAccess_ | Has Access<br/>_DatasetReadAccess_ | Any<br/>_DatasetReadyAny_ | __no__ | |
| 118 | +| GET | Datasets/fullquery | _DatasetRead_ | Public<br/>_DatasetReadManyPublic_ | Has Access<br/>_DatasetReadManyAccess_ | Has Access<br/>_DatasetReadManyAccess_ | Has Access<br/>_DatasetReadManyAccess_ | Has Access<br/>_DatasetReadManyAccess_ | Any<br/>_DatasetReadAny_ | __no__ | |
| 119 | +| GET | Datasets/fullfacet | _DatasetRead_ | Public<br/>_DatasetReadManyPublic_ | Has Access<br/>_DatasetReadManyAccess_ | Has Access<br/>_DatasetReadManyAccess_ | Has Access<br/>_DatasetReadManyAccess_ | Has Access<br/>_DatasetReadManyAccess_ | Any<br/>_DatasetReadAny_ | __no__ | |
| 120 | +| GET | Datasets/metadataKeys | _DatasetRead_ | Public<br/>_DatasetReadManyPublic_ | Has Access<br/>_DatasetReadManyAccess_ | Has Access<br/>_DatasetReadManyAccess_ | Has Access<br/>_DatasetReadManyAccess_ | Has Access<br/>_DatasetReadManyAccess_ | Any<br/>_DatasetReadAny_ | __no__ | |
| 121 | +| GET | Datasets/count | _DatasetRead_ | Public<br/>_DatasetReadManyPublic_ | Has Access<br/>_DatasetReadManyAccess_ | Has Access<br/>_DatasetReadManyAccess_ | Has Access<br/>_DatasetReadManyAccess_ | Has Access<br/>_DatasetReadManyAccess_ | Any<br/>_DatasetReadAny_ | __no__ | |
| 122 | +| GET | Datasets/findOne | _DatasetRead_ | Public<br/>_DatasetReadOnePublic_ | Has Access<br/>_DatasetReadOneAccess_ | Has Access<br/>_DatasetReadOneAccess_ | Has Access<br/>_DatasetReadOneAccess_ | Has Access<br/>_DatasetReadOneAccess_ | Any<br/>_DatasetReadAny_ | __no__ | |
| 123 | +| GET | Datasets/_pid_ | _DatasetRead_ | Public<br/>_DatasetReadOnePublic_ | Has Access<br/>_DatasetReadOneAccess_ | Has Access<br/>_DatasetReadOneAccess_ | Has Access<br/>_DatasetReadOneAccess_ | Has Access<br/>_DatasetReadOneAccess_ | Any<br/>_DatasetReadAny_ | __no__ | |
| 124 | +| PATCH | Datasets/_pid_ | _DatasetUpdate_ | __no__ | __no__ | Owner<br/>_DatasetUpdateOwner_ | Owner<br/>_DatasetUpdateOwner_ | Owner<br/>_DatasetUpdateOwner_ | Any<br/>_DatasetUpdateAny_ | __no__ | |
| 125 | +| PUT | Datasets/_pid_ | _DatasetUpdate_ |__no__ | __no__ | Owner<br/>_DatasetUpdateOwner_ | Owner<br/>_DatasetUpdateOwner_ | Owner<br/>_DatasetUpdateOwner_ | Any<br/>_DatasetUpdateAny_ | __no__ | |
| 126 | +| POST | Datasets/_pid_/appendToArrayField | _DatasetUpdate_ |__no__ | __no__ | Owner<br/>_DatasetUpdateOwner_ | Owner<br/>_DatasetUpdateOwner_ | Owner<br/>_DatasetUpdateOwner_ | Any<br/>_DatasetUpdateAny_ | __no__ | |
| 127 | +| | | | | | | | | | |
| 128 | +| DELETE | Datasets/_pid_ | _DatasetDelete_ | __no__ | __no__ | __no__ | __no__ | __no__ | __no__ | Any<br/>_DatasetDeleteAny_ | |
| 129 | +| | | | | | | | | | |
| 130 | +| GET | Datasets/_pid_/thumbnail | _DatasetRead_ | Public<br/>_DatasetReadPublic_ | Has Access<br/>_DatasetReadAccess_ | Has Access<br/>_DatasetReadAccess_ | Has Access<br/>_DatasetReadAccess_ | Has Access<br/>_DatasetReadAccess_ | Any<br/>_DatasetReadAny_ | __no__ | |
| 131 | +| | | | | | | | | | |
| 132 | +| POST | Datasets/_pid_/attachments | _DatasetAttachmentCreate_ | __no__ | __no__ | Owner<br/>_DatasetAttachmentCreateOwner_ | Owner<br/>_DatasetAttachmentCreateOwner_ | Any<br/>_DatasetAttachmentCreateAny_ | Any<br/>_DatasetAttachmentCreateAny_ | __no__ | |
| 133 | +| GET | Datasets/_pid_/attachments | _DatasetAttachmemntRead_ | Public<br/>_DatasetAttachmentReadPublic_ | Has Access<br/>_DatasetAttachmentReadAccess_ | Has Access<br/>_DatasetAttachmentReadAccess_ | Has Access<br/>_DatasetAttachmentReadAccess_ | Has Access<br/>_DatasetAttachmentReadAccess_ | Any<br/>_DatasetAttachmentReadAny_ | __no__ | |
| 134 | +| PUT | Datasets/_pid_/attachments/_aid_ | _DatasetAttachmemntUpdate_ | __no__ | __no__ | Owner<br/>_DatasetAttachmentUpdateOwner_ | Owner<br/>_DatasetAttachmentUpdateOwner_ | Owner<br/>_DatasetAttachmentUpdateOwner_ | Any<br/>_DatasetAttachmentCreateAny_ | __no__ | |
| 135 | +| DELETE | Datasets/_pid_/attachments/_aid_ | _DatasetAttachmemntDelete_ | __no__ | __no__ | Owner<br/>_DatasetAttachmentDeleteOwner_ | Owner<br/>_DatasetAttachmentDeleteOwner_ | Owner<br/>_DatasetAttachmentDeleteOwner_ | Any<br/>_DatasetAttachmentDeleteAny_ | __no__ | |
| 136 | + |
| 137 | +#### OrigDatablock |
| 138 | +| HTTP method | Endpoint | Endpoint Authorization | Anonymous | Authenticated User | Create Dataset Groups | Create Dataset with Pid Groups | Create Dataset Privileged Groups | Admin Groups | Delete Groups | Notes | |
| 139 | +| -------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | |
| 140 | +| POST | Datasets/_pid_/origdatablocks | _DatasetOrigdatablocksCreate_ | __no__ | __no__ | Owner<br/>_DatasetOrigdatablockCreateOwner_ | Owner<br/>_DatasetOrigdatablockCreateOwner_ | Any<br/>_DatasetOrigdatablockCreateAny_ | Any<br/>_DatasetOrigdatablockCreateAny_ | __no__ | |
| 141 | +| POST | Datasets/_pid_/origdatablocks/isValid | _DatasetOrigdatablocksCreate_ | __no__ | __no__ | Owner<br/>_DatasetOrigdatablockCreateOwner_ | Owner<br/>_DatasetOrigdatablockCreateOwner_ | Any<br/>_DatasetOrigdatablockCreateAny_ | Any<br/>_DatasetOrigdatablockCreateAny_ | __no__ | |
| 142 | +| GET | Datasets/_pid_/origdatablocks | _DatasetOrigdatablocksRead_ | Public<br/>_DatasetOrigdatablockReadPublic_ | Has Access<br/>_DatasetOrigdatablockReadOAccess_ | Has Access<br/>_DatasetOrigdatablockReadAccess_ | Has Access<br/>_DatasetOrigdatablockReadAccess_ | Has Access<br/>_DatasetOrigdatablockReadAccess_ | Any<br/>_DatasetOrigdatablockReadAny_ | __no__ | |
| 143 | +| PATCH | Datasets/_pid_/origdatablocks/_oid_ | _DatasetOrigdatablocksUpdate_ | __no__ | __no__ | Owner<br/>_DatasetOrigdatablockUpdateOwner_ | Owner<br/>_DatasetOrigdatablockUpdateOwner_ | Owner<br/>_DatasetOrigdatablockUpdateOwner_ | Any<br/>_DatasetOrigdatablockCreateAny_ | __no__ | | |
| 144 | +| DELETE | Datasets/_pid_/origdatablocks/_oid_ | _DatasetOrigdatablocksDelete_ | __no__ | __no__ | __no__ | __no__ | __no__ | __no__ | Any<br/>_DatasetOrigdatablockDeleteAny_ | | |
| 145 | + |
| 146 | + |
| 147 | +#### Datablocks |
| 148 | +| HTTP method | Endpoint | Endpoint Authorization | Anonymous | Authenticated User | Create Dataset Groups | Create Dataset with Pid Groups | Create Dataset Privileged Groups | Admin Groups | Delete Groups | Notes | |
| 149 | +| -------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | |
| 150 | +| POST | Datasets/_pid_/datablocks | _DatasetDatablocksCreate_ | __no__ | __no__ | Owner<br/>_DatasetDatablockCreateOwner_ | Owner<br/>_DatasetDatablockCreateOwner_ | Owner<br/>_DatasetDatablockCreateOwner_ | Any<br/>_DatasetDatablockCreateAny_ | __no__ | | |
| 151 | +| GET | Datasets/_pid_/datablocks | _DatasetOrigdatablocksRead_ | Public<br/>_DatasetDatablockReadPublic_ | Has Access<br/>_DatasetDatablockReadAccess_ | Has Access<br/>_DatasetDatablockReadAccess_ | Has Access<br/>_DatasetDatablockReadAccess_ | Has Access<br/>_DatasetDatablockReadAccess_ | Any<br/>_DatasetDatablockReadAny_ | __no__ | | |
| 152 | +| PATCH | Datasets/_pid_/datablocks/_oid_ | _DatasetDatablocksUpdate_ | __no__ | __no__ | Owner<br/>_DatasetDatablockUpdateOwner_ | Owner<br/>_DatasetDatablockUpdateOwner_ | Owner<br/>_DatasetDatablockUpdateOwner_ | Any<br/>_DatasetDatablockCreateAny_ | __no__ | | |
| 153 | +| DELETE | Datasets/_pid_/datablocks/_oid_ | _DatasetDatablocksDelete_ | __no__ | __no__ | __no__ | __no__ | __no__ | __no__ | Any<br/>_DatasetDatablockDeleteAny_ | |
| 154 | +| | | | | | | | | | |
| 155 | +| GET | Datasets/_pid_/logbook | _DatasetLogbookRead_ | __no__ | Owner<br/>_DatasetLogbookReadOwner_ | Owner<br/>_DatasetLogbookReadOwner_ | Owner<br/>_DatasetLogbookReadOwner_ | Owner<br/>_DatasetLogbookReadOwner_ | Any<br/>_DatasetLogbookReadAny_ | __no__ | | |
0 commit comments