We are announcing some changes in token ACLs:
- ACL entries "gw" and "storage" will be removed. You should use item-specific entries (gw/channels, storage/containers, etc)
- When you specify access for an item and also specify access for its submodules, then access for non-mentioned submodules is denied. If you don't specify access for submodules then ACL behavior will remain unchanged.
- All the ACLs created before 8 October 2020 will be updated to new format automatically.
- Almost all the flespi users will not be affected by these changes since their usage pattern suits for old and new approaches.
When?
Starting from today (24 September 2020) you will receive warning messages if your ACL usage is deprecated. On 8 October 2020 we will update all the tokens and apply changes mentioned above.
Details
Abandoning "gw" and "storage" items
99% users do not use this global items. These items have very wide scope and are not applicable for real life use cases. It is decided to remove them.
Moving from implicit submodules access to explicit only approach
How does it work now?
When you specify access for an item and do not specify access for its submodules, then submodules access is defined by their item (i.e. access is implicitly inherited).
Example ACL entry:
{
"uri": "gw/channels",
"ids": "all",
"methods": ["GET", "PUT"],
"submodules": [
{
"name": "messages",
"methods": ["GET", "DELETE"]
}
]
}
- explicitly allows to GET, PUT /gw/channels/{selector}
- explicitly allows to GET, DELETE /gw/channels/{selector}/messages
- implicitly allows to GET, PUT any non-specified submodules /gw/channels/{selector}/{logs, connections, etc}
How will it work?
When you specify access for an item and also specify access for its submodules, then access for non-mentioned submodules is denied.
Example ACL entry.
{
"uri": "gw/channels",
"ids": "all",
"methods": ["GET", "PUT"],
"submodules": [
{
"name": "messages",
"methods": ["GET", "DELETE"]
}
]
}
- explicitly allows to GET, PUT /gw/channels/{selector}
- explicitly allows to GET, DELETE /gw/channels/{selector}/messages
- denies all the request to non-mentioned modules (i.e. does not allow what is not mentioned)
How to avoid warnings?
If you need to use some submodules in ACL and you want to avoid warnings, then you may explicitly deny access for all unused submodules.
Let's assume you need to GET, PUT all streams and assign devices to them. Then you might have the following ACL entry:
{
"uri": "gw/streams",
"ids": "all",
"methods": ["GET", "PUT"],
"submodules": [
{
"name": "devices",
"methods": ["GET", "POST", "DELETE"]
}
]
}
To avoid receiving warnings you may explicitly deny access to "channels" and "logs" submodules:
{
"uri": "gw/streams",
"ids": "all",
"methods": ["GET", "PUT"],
"submodules": [
{
"name": "devices",
"methods": ["GET", "POST", "DELETE"]
},
{
"name": "channels",
"methods": []
},
{
"name": "logs",
"methods": []
}
]
}
