Page History

...

DELETE /api/latest/virtualhost/myvhn/myvh/userpreferences/query/mypref
DELETE /api/latest/virtualhost/myvhn/myvh/userpreferences/query/?id=75d5d2a4-0573-11e6-b512-3e1d05defe7
DELETE /api/latest/virtualhost/myvhn/myvh/userpreferences/query

DELETE /api/latest/virtualhost/myvhn/myvh/preferencesuserpreferences

REST API /visiblepreferences - retrieve visible preferences for

...

user

This API permits a caller to retrieve all preferences that are visible to the user, excluding those that belong to him.

A client application may permit the user to 'clone' one of these preferences so that the user may make his own modifications.  There is no direct backend support for this above a GET to this URI, followed by a suitable POST/PUT to /preferencesuserpreferences.  The clone is entirely independent of the original.

For GET, /visiblepreferences works in the same manner as /userpreferences.   The other HTTP methods are unsupported.

...

• establish that the business rules (name uniqueness, cardinality rules, mutablity of id/name) are not broken by the proposed changes
• check with the security manager that the update of the preferences is allowed

...

• on type, type/name or id
• if a /userpreferences request - a predicate that encapsulates preference.owner == authenticate user
  if a /visiblepreferences request - a predicate that encapsulate authenticated user is member of a group included in preference.visiblityList && preference.encapsulates preference.owner <> authenticate user

...

public interface Preference<V extends PreferenceValue>
{
 UUID getId();
 String getName();
 String getType();
 String getDescription();
 Principal getOwner();
 ConfiguredObject getAssociatedObject()
 List<Principal> getVisibiltyList();
 Date getCreatedDate();
 Date getLastUpdatedDate();
 
 V getValue();
 Map<String,Object> getAttributes();
}
 
public interface PreferenceValue
{
  Map<String,Object> getAttributes();
}

...

{
 id: <UUID - immutable>,
 name: <name - immutable>,
 type: <type discriminator>
 description: <description>,
 associatedId: <UUID of model object - immutable>,
 owner: <Domain prefixed Principal - normally that belonging to a user - immutable>,
 visibliltyList: [<Domain prefixed Principal - normally that belonging to a group>],
 value: {
   ...
 },
 createdDate: 123456789,
 updatedDate: 123456789
} 

Security Manager

The security manager will gain responsibilities for authorising preference operations.

• authoriseCreate(Preference new)
• authoriseUpdate(Preference existing, Preference new)
• authoriseDelete(Preference)
• authoriseAccess(Preference)

view/create/update/delete operations.

The Security Manager will first need to check that the user has access to the ConfiguredObject itself.  For the moment the ordinary user operations we will probably use the existing ACL rules CONFIGURE BROKER and ACCESS VIRTUALHOST.

For the super-user, we will need a new permission will be required (ACCESS PREFERENCES).  A user in the identity maintainer role will normally hold this.

SecurityManager#authoriseCreate

Returns true if the user is allow to create the preference. It will be true if:

• the user belongs to all the groups identified in the visibilityList
• the owner matches the authenticated user.

SecurityManager#authoriseUpdate

Returns true if the user is allow to update the preference. It will be true if:

• the user belongs to all the groups identified in the visibilityList
• the owner matches the authenticated user.

SecurityManager#authoriseView

Returns true if the user is allow to view this preference:

• authenticated user owns the preference, or
• authenticated user belongs to a group that is visible to the visibilityList
• authenticate user is the super user.

SecurityManager#authoriseDelete

Returns true if the user is allow to delete this preference:

• authenticated user owns the preference, or
• authenticate user is the super user.

Preference Store

We will have a PreferenceStore interface rather like DurableConfigurationStore

...