Skip to content

feat(storage)!: storage authz completion - #1279

Draft
ChrisPdgn wants to merge 3 commits into
mainfrom
v-next-storage-authz
Draft

feat(storage)!: storage authz completion#1279
ChrisPdgn wants to merge 3 commits into
mainfrom
v-next-storage-authz

Conversation

@ChrisPdgn

@ChrisPdgn ChrisPdgn commented Jan 21, 2025

Copy link
Copy Markdown
Contributor

This PR implements #1173. Please check in there for more details.

Breaking change:

  • Client routes no longer allow container creation

Additional features:

  • If no folder is provided in file creation, a personal folder is created with name cnd_${user._id}

Bugs found & fixes:

  • Admin endpoint for folder deletion did not delete subfolders and subfolder files
  • Container deletion in local provider was not possible

Notes:

  • Containers can own files directly if file folder is '/', otherwise they can own folders that can own folders or files, e.tc.
  • Admin users can create scoped containers, but default container cannot be owned
  • Admin users can create scoped folders with admin endpoint & client users can create scoped folders through file creation (if allowed to do so)

What kind of change does this PR introduce?

  • Bugfix
  • Feature
  • Code style update
  • Refactor
  • Build-related changes
  • Other (please describe)

Does this PR introduce a breaking change?

  • Yes
  • No

The PR fulfills these requirements:

  • It's submitted to the main branch
  • When resolving a specific issue, it's referenced in the PR's description (e.g. fix #xxx, where "xxx" is the issue number)

If adding a new feature, the PR's description includes:

  • A convincing reason for adding this feature

Other information:

@ChrisPdgn ChrisPdgn changed the title feat(storage): storage authz completion feat(storage)!: storage authz completion Jan 22, 2025
@kkopanidis
kkopanidis requested a review from kon14 January 22, 2025 12:01
@ChrisPdgn
ChrisPdgn marked this pull request as draft September 8, 2026 14:26
Register Container, Folder, and File as a filesystem-shaped ReBAC
tree using the current oncePeerUp authz lifecycle.

Client file APIs no longer create missing containers. An omitted
folder resolves to a personal cnd_<userId>/ folder, and creating
under another user's missing personal root is denied.

Fixes #1173

BREAKING CHANGE: Client storage APIs return 404 for missing
containers instead of creating them. An omitted folder now
creates cnd_<userId>/.
Share admin container/folder setup, resolve file ids consistently,
and drop the unused getFileUrl fallback.
Keep implementation files in authz/ and handlers/ and collect the
authz coverage in one dedicated test folder.
@cursor
cursor Bot force-pushed the v-next-storage-authz branch from b7a5505 to 6104ff6 Compare September 9, 2026 09:04
@cursor
cursor Bot changed the base branch from v-next to main September 9, 2026 09:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants