Because of listing visibility, if no actions are assigned to a user for
an individual resource, it's excluded from the list. This is fine and
good. However, when we made a change in 0.2.0 to restrict the
information returned from listing for the anonymous user for scopes and
auth methods, it exposed the fact that because of the way this
visibility works we had to add `read` to scopes by default -- thereby
rather defeating the purpose of restricting what goes back to `u_anon`
requests.
The purpose of "no-op" is to never be used for real actions within the
API, but as something that can be granted to specifically enable
visibility for the targeted user. This makes the controls over list
visibility much more granular.
Current behavior is that you need list grant on the parent scope when
recursively listing, and this is sufficient. This is good for
administrative workflows but can be unintuitive for resources that only
exist at a project level. This change allows permissions on the child
scope to also be taken into account, so that you can start a recursive
list from a parent scope without direct list support on that scope but
still get back child scopes for which list access is granted.
This also fixes a bug where visibility of a scope for recursive listing
would be based on whether the user had list resources for roles within
that scope instead of for the resource type in question.
* Update deps
This also updates for the new (and required) paradigm for registering
service implementations as spelled out in
https://github.com/grpc/grpc-go/issues/3385
* Roll back dockertest
* Scopes inline version into update request body.
* Users inline version into update request body.
* Group inline version into update and add|set|remove member request body.
* Role inline version into update and add|set|remove grant|principal request body.
* Auth method inline version into update request body.
* Auth Account inline version into update request body.
* host catalog version is inlined for update.
* Gen after merge.
* Submitting template changes for version handling.
* Change auth validity feedback
Move from a bool indicating validity to lack of an error. This allows
the error to be directly returned and typed.
* Fix erroneous line
* Feature: Create MaskManager logic to handle project -> scope update mask logic.
* Updating resource protos and services to use new mask manager setup.
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* Create user handler stuff.
* Fixing Not Found errors from DB.
* Fixing param names.
* Update the proto's go package generation.
* Generate the user resource.
* Adding SDK methods for users.
* Fix the base type of Users and add tests.
* Connect user service to the controller handler.
* Attach the default org to the Test Controller's client.
* Take into account the provided request paths when the client builds the org/project path prefix.
* Adding comments to the API.
* rename repo function to repoFn.
* Fix typo in update mask errors.
* Clean up tests.
* Remove special checks for request url content in the api client and fix CORS test.
Jeff Mitchell
Jim
s-christoff
Todd Knight
Louis Ruch