[API] Privileges via Groups

[andersevenrud]

OS.js definately needs privilege support via groups. This is easily doable via the Handler.

It basically only needs to throw an Exception when calling certain functions server-side.

Demo handler will make all users have FULL PRIVILEGES

Groups:

admin - Full privileges

api - Core API Access
application - Application API
vfs - Filesystem read/write
upload - Filesystem upload
curl - cURL access

Frontend

• Hide packages that you do not have privileges to
• Add more user information in Settings application

PHP

• Implement a check method
• Implement check call in API methods
• Add checks to packages
• Filesystem paths etc

How to add privilege to a custom function:

class TestAPIHandler
  extends APIHandler
{

  public static function myFunction(Array $arguments) {
    // ...
  }

}

API::AddHandler('myFunction', Array('TestAPIHandler', 'myFunction'), Array(APIUser::GROUP_VFS, 'customgroup'));
API::SetHandler('TestAPIHandler');

Node

• Implement a check method
• Implement check call in API methods
• Add checks to packages
• Filesystem paths etc

How to add privilege to a custom function:

(function() {

  exports.register = function(CONFIG, API, HANDLER) {

    API.myFunction= function(args, callback, request, response) {

      if ( !HANDLER.checkPrivilege(request, response, ['groupname']) ) {
        return;
      }

      // ...
    };

  };

})();

[andersevenrud]

@livep2000 It's on its way ;) It works in the PHP server now at least.

[andersevenrud]

@khoaakt Just letting you know that I've started on this ;)

[andersevenrud]

That was easier than I first thought... The ground-work is there now :)

[khoaakt]

@andersevenrud Good job ;), but don't hurry because it will waste time for bug fixes

[livep2000]

@andersevenrud : love ye !

Got a custom handler running now, accessing my own userdatabase.
With use of the new nginx configuration file.

I'll wait a bit before I translate my sites usergroups to your privilege template.
But looks good so far!

Imre

[andersevenrud]

@khoaakt I have no issues marked as bug. And have not recieved a bug-request in ages. ;)

[andersevenrud]

Superseeded by #304