Handling permission on a Kinto Server

Abstract

Keeping up with permission proves to be something complex especially when you have lots of groups and when the data is very sensitive so that you don't want to make mistakes.

In order to make it easier and to avoid making mistakes we decided to have developers maintain a YAML file that will describe the permission model that will then be applied to the Kinto server with a script ran with administrative permission.

YAML File Structure

bucket1:
  permissions:
    write:
      - principal1
      - principal2
      - /buckets/bucket1/groups/group1
    read:
      - principal1
      - principal2
  collections:
    collection1:
      data:
        schema: file://./collection1_schema.json
      permissions:
        write:
          - /buckets/bucket2/groups/group1
  groups:
    group1:
      - principal1
      - principal2

bucket2:
  permissions:
    write:
      - principal1
      - principal2
      - /buckets/bucket2/groups/group1
    read:
      - principal1
      - principal2
  collections:
    collection1:
      permissions:
        write:
          - /buckets/bucket2/groups/group1
  groups:
    group1:
      - principal1
      - principal2