3 ms·

One of the things I really need to sort on csvbase is permissions. Currently it has something very basic: you own your table and it's either public (meaning ev

One of the things I really need to sort on csvbase is permissions. Currently it has something very basic: you own your table and it's either public (meaning everyone has read) or private (meaning only you have read). I really don't want to implement, eg RBAC, by myself but equally the state-of-the-art seems to be integration against pretty complicated external stuff (/cloud services) which is also undesirable when it's your side-project. Advice appreciated. I suspect LDAP is not a fit but I will investigate it...

zer00eyz 3y ago
Funny where talking about this: I have spent the last two weeks deep into Postgres roles. The whole system is, to say the least, convoluted. I think I need to write "Postgres roles for dummies"... because I feel like one. Ldap would be a great fit. And go go read here: https://www.zytrax.com/books/ldap/ https://www.zytrax.com/books/ldap/ if you want a dive that you can wrap your head around. Candidly I would NOT go for ldap or RBAC now. The two things I would try to bite off are shared ownership, and then revokable tokens at the table level. It's up to the token creator what permissions to give them (read/write), how long they should last, and if they want to just publish them or create one per "user".
withinboredom 3y ago
Heh, I suspect you are on the right path: https://news.ycombinator.com/item?id=40054085 https://news.ycombinator.com/item?id=40054085
_factor 3y ago
You probably want to grant full rights to an outside authentication/authorization service that handles the fine grained rights for private tables. That way you don’t lock the main functionality up with the rights management aspect and 1,000+ custom permissions and role sets. Authorization is the front door to a hallway with keyed doors behind. Have a peep hole to authenticate where necessary, but don’t complicate the core product with it. Heck, roll your own version if you have time. With this system you can change it in and out and not have to rewrite your base to accommodate. An oversimplification, as are most things. My .02c

zer00eyz 3y ago

Funny where talking about this: I have spent the last two weeks deep into Postgres roles. The whole system is, to say the least, convoluted. I think I need to write "Postgres roles for dummies"... because I feel like one. Ldap would be a great fit. And go go read here: https://www.zytrax.com/books/ldap/ https://www.zytrax.com/books/ldap/ if you want a dive that you can wrap your head around. Candidly I would NOT go for ldap or RBAC now. The two things I would try to bite off are shared ownership, and then revokable tokens at the table level. It's up to the token creator what permissions to give them (read/write), how long they should last, and if they want to just publish them or create one per "user".

withinboredom 3y ago

Heh, I suspect you are on the right path: https://news.ycombinator.com/item?id=40054085 https://news.ycombinator.com/item?id=40054085

_factor 3y ago

You probably want to grant full rights to an outside authentication/authorization service that handles the fine grained rights for private tables. That way you don’t lock the main functionality up with the rights management aspect and 1,000+ custom permissions and role sets. Authorization is the front door to a hallway with keyed doors behind. Have a peep hole to authenticate where necessary, but don’t complicate the core product with it. Heck, roll your own version if you have time. With this system you can change it in and out and not have to rewrite your base to accommodate. An oversimplification, as are most things. My .02c