Versions Compared

Version Old Version 7 New Version 8
Changes made by

Alx Dark (Unlicensed)

Alx Dark (Unlicensed)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. Consistent with what we’ve done and thus the least code churn;

  2. Possibly easier for external users to understand;

  3. Possibly easier to secure down the road with Spring Security (using URL-based security rather than method-based security);

Cons

  1. Honestly I was going to say “more code” but after looking at the other options, it might still be the best way to proceedtrying to eliminate keywords like “self” that make more endpoints…that’s more to add to the SDK, more to test, more to document, etc. Putting all the security within the system is easier;

  2. Some security checks might get tedious. You might still want a DSL class for this. The delete user is a good example:

    Code Block
    languagejava
    boolean orgAdminDelete = context.isInRole(ORG_ADMIN) && !account.getRoles().isEmpty() && 
        context.getCallerOrgMembership().equals(account.getOrgMembership());
boolean testDelete = AuthUtils.isSelfResearcherOrAdmin(context.getCallerUserId()) &&
            account.getDataGroups().contains(TEST_USER_GROUP);
boolean adminDelete = context.isInRole(ADMIN);

if (!orgAdminDelete && !testDelete && !adminDelete) {
    throw new UnauthorizedException();
}