Roles and permissions

[kulmann]

Work In Progress 🚧

Implementation for owncloud/product#85
Also fixes #32

Required cleanup before review/merge:

• bring back the commented tests
• document folder structure of bundles and values
  • tracker: https://github.com/owncloud/ocis-settings/issues/13
  • add to hugo docs
• replace path with filepath
• protect all API endpoints with respective permissions
  • on writing values (especially when the values are meant to be global, i.e. when setting has resource type SYSTEM)
  • on listing settings bundles (separate from listing roles)
  • on saving a bundle
  • on reading a bundle
  • on adding a setting to a bundle
  • on removing a setting from a bundle
  • on listing values
  • on saving a value
  • on reading a value
  • on listing roles
  • on listing role assignments
  • on adding role assignments
  • on removing role assignments
• additional check: is the authenticated user (account UUID in the access token) allowed to perform the request for the account UUID in the request?
• avoid duplicates when adding role assignments
  • we can write a red test here

Create and merge pull requests for adapting to the new data model and using the new roles & permissions system in

• ocis-accounts: adapt to new keys in settings and settings bundles
• ocis-proxy: new middleware for fetching roles and minting them into the token
• ocis-hello: change registering settings bundles to new identifier
• owncloud-sdk: copy the regenerated api client from ocis-settings into the vendor dir and adapt code to new identifier
• phoenix: release with new owncloud-sdk and data model changes
• ocis-phoenix: release with new phoenix

[refs]

@kulmann made some changes to align the mount path for the settings and as a result got the following tree:

/var/tmp/ocis-settings
❯ tree .
.
├── bundles
│   └── ocis-settings
│       ├── admin.json
│       ├── guest.json
│       └── user.json
└── ocis-settings
    └── bundles
        └── ocis-settings
            ├── admin.json
            ├── guest.json
            └── user.json

5 directories, 6 files

The nested ocis-settings seems redundant.

[refs]

With my patch now the folder structure is:

/var/tmp/ocis-settings
❯ tree /var/tmp/ocis-settings
/var/tmp/ocis-settings
└── bundles
    └── ocis-settings
        ├── admin.json
        ├── guest.json
        └── user.json

2 directories, 3 files

Testing to check the core functionality doesn't break.

[kulmann]

For the record, we moved the code into four separate PRs:

• Refactor data model #46
• Add roles service #47
• Filter settings by permissions #48
• Error handling #49

[kulmann]

Tracked account uuid validation here https://github.com/owncloud/ocis-settings/issues/50

[kulmann]

this entire PR was split into multiple other PRs and is not needed anymore.