Date: Fri, 23 Nov 2018 20:37:16 +0200
From: Lars Wirzenius <liw@liw.fi>
To: ick-discuss@ick.liw.fi
Message-ID: <20181123183716.GB5774@exolobe1.liw.fi>
MIME-Version: 1.0
User-Agent: Mutt/1.10.1 (2018-07-13)
Subject: New Ick component: Muck, for JSON storage
Precedence: list
Content-Type: multipart/mixed; boundary="===============2330713778803060933=="
Mime-version: 1.0
Sender: ick-discuss-bounces@ick.liw.fi
Errors-To: ick-discuss-bounces@ick.liw.fi


--===============2330713778803060933==
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="BwCQnh7xodEAoBMC"
Content-Disposition: inline


--BwCQnh7xodEAoBMC
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi all.

One of the problems Ick currently has is that every user can see, and
modify, and delete, any project and any pipeline of any user. To fix
this, Ick needs to assign an owner to each such "resource", and only
allow authorized users to access the resource.

To begin with, "authorized" will mean "is owned by", but later this
will become more flexible: the owner will be able to specify for
various groups of users what they can do.

The first step is to introduce the concept of resource ownership. For
this, I intend to add a new component to Ick, which stores structured
data in the form of JSON objects. I've written a proof-of-concept
prototype of this, and it's called Muck. The code is at
<http://git.liw.fi/muck-poc>. A README has some documentation:
zhttp://git.liw.fi/muck-poc/tree/README>.

Muck stores JSON objects in memory, but persistently: they get written
to disk and loaded back into memory if the service is restarted.
Access is via a RESTful HTTP API, with authorization handled by signed
JWT access token provided by Qvisqve. In other words, exacly like the
controller and artifact store.

Unlike the controller and artifact store, however, each resource is
assigned an owner upon creation. The owner is taken from the "sub"
claim of the access token. For now, only the owner can see, update, or
delete the resource.

Each resource is assigned a random identifier by Muck. There is a way
to search for resources, based on metadata or resource content.

Muck exists. I will (slowly) start converting the controller and other
components, and API users, to use it. Once that is done, mortal
enemies will be able to share an Ick instance without having to fear
each other.

Thoughts?

--=20
I want to build worthwhile things that might last. --joeyh

--BwCQnh7xodEAoBMC
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEETNTnrewG6wEE1EJ3bC+mFux6IDEFAlv4SNsACgkQbC+mFux6
IDFaig/+I5IMJgdEEjMxtCoy/+v9rHGKSTbSZKdTSSvl6U6D6+1eOpDyvJDd5aUK
o83jhQk7rLxndZ76gKw4ADiuBNh+mLCg9evfJ/Y9FtYitbZu5rKiakuHabl+H7cT
PmOq4sVmHyZgbME00pr0Lyup70KoVZAsNFrx9uPuJ7KCED2wkXf71hgi5KuYjXvI
JktUSoclZsil//th/0nkCDcPYy0W1imGcRndGxZb7sFMDihYXSGV6rccp6Q59xCB
bmRFAGM6sKXRAr6WV33Hy3broWl6ZvarA9biotmgj+Nm/OZXH1KFoJv8MXrbF8Wy
uy1SHNGUiifdamZ7+brqGnS36kNXuoTJF0GYn4pZJ0djtVoSeWOFt6SiYwRLvmnl
h2dLmaeumabMizE08CIRNXRunwd9cF7gd0taq5W2aHRs4PpNCdJOE1n7K3ZWlcjo
TGDMYVzIWY0Sbm4v63sx+Ao7NgO8WCTAptosKlWK20gpW0DWPZtkuteFu+SMIXCh
Xh8PvyVVFdQSkH2dR64mF3CWf2m2a7u2vPeRMRvKOkzy376m8x6T5yQu7fUioQhD
hNQ9HPmYcd2qmh/KSg8rtlHc5asLzIPSN5/fSlXZbMBU2LU5v3yPMZj43+0rOZYc
oYVashz3X+OJB2c2W6iChRY6VGHRNgYiSj17W5hJduYAiUytM7c=
=hHvB
-----END PGP SIGNATURE-----

--BwCQnh7xodEAoBMC--


--===============2330713778803060933==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
ick-discuss mailing list
ick-discuss@ick.liw.fi
https://listmaster.pepperfish.net/cgi-bin/mailman/listinfo/ick-discuss-ick.liw.fi

--===============2330713778803060933==--