Groups Projects Ownership and Permissions Specification » History » Version 5
Peter Amstutz, 08/06/2014 10:49 PM
| 1 | 1 | Peter Amstutz | h1. Groups, Projects, Ownership and Permissions Specification |
|---|---|---|---|
| 2 | |||
| 3 | 3 | Peter Amstutz | h2. Permissions |
| 4 | |||
| 5 | 2 | Peter Amstutz | * There are three levels of permission, *can_read*, *can_write*, and *can_manage*. |
| 6 | ** *can_read* grants read-only access to the record |
||
| 7 | ** *can_write* permits changes to content (but not metadata) fields of the record. *can_write* also implies *can_read* |
||
| 8 | ** *can_manage* permits the user to create permission links with @head_uuid@ set to this object. *can_manage* also implies *can_write* and *can_read* |
||
| 9 | 3 | Peter Amstutz | |
| 10 | 4 | Peter Amstutz | If a user does not have at least *can_read* permission, the user is forbidden from |
| 11 | |||
| 12 | 3 | Peter Amstutz | h2. Ownership |
| 13 | 1 | Peter Amstutz | |
| 14 | * All Arvados objects have an @owner_uuid@ field. Valid uuid types for @owner_uuid@ are "User" or "Group". |
||
| 15 | 4 | Peter Amstutz | * The User or Group specified by @owner_uuid@ has *can_manage* permission on that object. |
| 16 | 3 | Peter Amstutz | * If @owner_uuid@ of an object is a Group, then that object is a member of that group, and should be displayed as being contained within the owner Group. |
| 17 | ** A "Project" is a subtype of Group that indicates the group should be displayed in the "Projects" section of Workbench. |
||
| 18 | |||
| 19 | 5 | Peter Amstutz | h3. Questions |
| 20 | |||
| 21 | Moving an object from Group A to Group B implies changing the @owner_uuid@ field from Group A to Group B. |
||
| 22 | |||
| 23 | * What permission is required on the object itself to change the @owner_uuid@ field? |
||
| 24 | * What permission is required on Group A to change the object @owner_uuid@ field so it no longer points to Group A? This logically removes the object from Group A. |
||
| 25 | * What permission is required on Project B to set the object @owner_uuid@ field to Group B? This logically adds the object to Group B. |
||
| 26 | |||
| 27 | 1 | Peter Amstutz | h2. Permission links |
| 28 | 3 | Peter Amstutz | |
| 29 | 4 | Peter Amstutz | A link object with |
| 30 | 1 | Peter Amstutz | |
| 31 | 4 | Peter Amstutz | * @link_class@ "permission" |
| 32 | * @name@ one of *can_read*, *can_write* or *can_manage* |
||
| 33 | * @head_uuid@ of some Arvados object |
||
| 34 | * @tail_uuid@ of an User or Group |
||
| 35 | |||
| 36 | grants the @name@ permission for @tail_uuid@ accessing @head_uuid@ |
||
| 37 | |||
| 38 | 1 | Peter Amstutz | h2. Transitive permissions |
| 39 | 3 | Peter Amstutz | |
| 40 | * If a User *can_read* Group A, and Group A *can_read* group B, then User *can_read* Group B. |
||
| 41 | 4 | Peter Amstutz | * Permissions are narrowed to the least powerful permission on the path. |
| 42 | 3 | Peter Amstutz | ** If User *can_write* Group A, and Group A *can_read* Group B, then User *can_read* Group B. |
| 43 | ** If User *can_read* Group A, and Group A *can_write* Group B, then User *can_read* Group B. |