Repository navigation
Features Files, Assets and auth mode UserOrApplication -> UserXORApplication - #2952
Open
simonredfern wants to merge 7 commits into
Open
simonredfern wants to merge 7 commits into
simonredfern wants to merge 7 commits into
Conversation
CanCreateAsset at the bank) so a bank can register an asset it issues and SYS a crypto asset; the registry enforces the 4-10 character rule for bank-issued codes, the chain scheme list and the DTI shape, a taken code, chain identity or DTI is 409, and the creator is stored as the User acted for. + fix: Make sure that Get Thread Replies and Get Reactions in v6.0.0 only return those of a message in the chat room in the path + feature: record who created an account through v7.0.0 Create Account and for whom, return it as metadata.created, and add Get Account Directory v7.0.0 showing it per account
UserXORApplication: a request is either a person acting on their own Entitlements or an application acting as itself (no User, or its own obp-oidc#client client-credentials User) on its Consumer's Scopes, never a mix, so a person calling through a Consumer no longer gets its Scopes and who is let in is who is recorded as acting. The require_scopes props no longer make an application acting as itself also need Entitlements. Dynamic Entity auth_mode still accepts UserOrApplication and stores it as UserXORApplication + feature: v7.0.0 Open Corridor attach promise evidence, settlement, fee settlement and get settlement are UserXORApplication, so a bank's Bank Node can call them as itself with a client-credentials token + feature: add Files to v7.0.0: store a document or photograph in a space (POST /banks/BANK_ID/files, base64 in JSON, Role CanCreateFileAtOneBank, or a Role at SYS for the system space, no AtAnyBank Roles), read it, its content and its attachments as owner, a User given access or with CanGetFileAtOneBank, attach it to records, share it, and make it public with CanCreatePublicFileAtOneBank. Public files are served without login by separate public-files endpoints that serve nothing else. Media types are at most jpeg, png, webp and pdf, and the content must match its type + fix: Make sure that file content responses keep their own Content-Type and send nosniff and a sandbox Content-Security-Policy, and that file bytes can be stored on H2
/obp/v7.0.0/management/banks/BANK_ID/files, Role CanGetFileAtOneBank at the bank or SYS) so an administrator can list every file of a space, newest first, whoever owns it, paginated with limit (1 to 500, default 500) and offset, with pagination.total; used by the API Manager Files page + fix: Make sure that the Files tables apply their attribution policy (the caller and the User an agent acted for are both recorded, via attributionOf) and that Create File Access refuses a consent user as grantee, since access given to one would end with its Consent; the Glossary item Files now explains attaching files to records.
CanDeleteEntitlementRequestsAtAnyBank to superAdminVirtualRoles + more uses of holdsVirtualRole
registry's rules with 400 before it looks for a taken code, chain identity or DTI, so a three-letter bank-issued code that is also an ISO currency (e.g. BND) returns a 400, not a 409 + fix: Make sure that the tests follow UserXORApplication and the Files guards: AggregateMetricsTest checks that a Consumer with the Scope reads aggregate metrics as itself while a person signing with it still needs an Entitlement, ExplicitTargetConsentUserSweepTest probes the Create File Access consent-grantee guard (21 guards), and FileAccess_GranteeUserId is listed again as an explicit target not reached by a consent user
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.