Finalize the component to attach entities

[tschaffter]

#523 (comment)

[tschaffter]

Discussion on how to handle authorization for attachments.

• A user can add/remove attachments (entities) to an entity A if the user has Write access to entity A.

• It is possible that there are entities attached that are not visible (public or with the required permission) to the user who makes the request. Here I propose that if a user has Read access to an entity A, then he can get minimal information about each attachment to A independently of whether he has access to it. This small set of information could be represented by the following model:

interface EntityPreview {
    _id: string;
    title: string;
    picture: string;
    createdBy: UserProfile
}

With the above information, the user can see the full list of attachments with the current visual (see screenshot). When the user click on an attachment to navigate to the page of the attachment, a request is sent to the server and the entire entity object is returned if the user has effectively Read access to it. Otherwise, an error code 403 (Forbidden).

Enhancement

Post Milestone 2, we could add the option for the user to easily request access to an attachment the user does not have access to.

When a user requests Read access to an entity, we would send a notification to all the users who have Admin access to the entity. As soon as one of the admins accepts or declines the request, the request would be removed (or updated to inform them that the request has been addressed by the user X) from the notifications of the other admins and a response would be send back to the requester.

[tschaffter]

The direction I'm taking goes down to the following choices:

1. A user with Read access to an entity A can get the list of object ID of the entities attached to A.

When now want to render a list of visuals for the attachments. The current visual relies on the following entity information:

• title
• picture
• type
• subType (e.g. Memo or Report for Insight)

The question is what to do if the user has not access to an entity. For now the easiest solution is also the most tight in terms of security: the client sends a request to the server for each attached entity and the server returns the one the user has access to, or an error 403. For now the easiest solution will be to show an empty attachment for requests that returns a non-successful code.

[tschaffter]

Ultimately authorization is not the error to manage when querying an attached entity. The attached entity may have been delete and so is no longer accessible.