{"action":"created","issue":{"url":"https://api.github.com/repos/openmicroscopy/openmicroscopy/issues/3543","labels_url":"https://api.github.com/repos/openmicroscopy/openmicroscopy/issues/3543/labels{/name}","comments_url":"https://api.github.com/repos/openmicroscopy/openmicroscopy/issues/3543/comments","events_url":"https://api.github.com/repos/openmicroscopy/openmicroscopy/issues/3543/events","html_url":"https://github.com/openmicroscopy/openmicroscopy/pull/3543","id":59223295,"number":3543,"title":"Policy for download restriction","user":{"login":"joshmoore","id":88113,"avatar_url":"https://avatars.githubusercontent.com/u/88113?v=3","gravatar_id":"","url":"https://api.github.com/users/joshmoore","html_url":"https://github.com/joshmoore","followers_url":"https://api.github.com/users/joshmoore/followers","following_url":"https://api.github.com/users/joshmoore/following{/other_user}","gists_url":"https://api.github.com/users/joshmoore/gists{/gist_id}","starred_url":"https://api.github.com/users/joshmoore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshmoore/subscriptions","organizations_url":"https://api.github.com/users/joshmoore/orgs","repos_url":"https://api.github.com/users/joshmoore/repos","events_url":"https://api.github.com/users/joshmoore/events{/privacy}","received_events_url":"https://api.github.com/users/joshmoore/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/openmicroscopy/openmicroscopy/labels/develop","name":"develop","color":"02e10c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":20,"created_at":"2015-02-27T11:17:22Z","updated_at":"2015-03-06T14:45:05Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/openmicroscopy/openmicroscopy/pulls/3543","html_url":"https://github.com/openmicroscopy/openmicroscopy/pull/3543","diff_url":"https://github.com/openmicroscopy/openmicroscopy/pull/3543.diff","patch_url":"https://github.com/openmicroscopy/openmicroscopy/pull/3543.patch"},"body":"See: https://trello.com/c/Y1YocYjU/323-download-button-restriction\r\n\r\nAdd support for limiting the download of original files. The basic functionality is that it is now possible to configure the server to limit access to original files, for example, preventing downloading the fileset.\r\n\r\n## Client-side: Add Permissions.extendedRestrictions mechanism\r\n\r\nIn order to allow further canEdit/canDelete/...-like\r\nfunctionality, a second field on Permissions has been\r\nadded which contains strings documented and set by\r\nindividual services at runtime. Failure to obey these\r\nrestrictions in the client will lead to an exception.\r\n\r\n## Server-side: ome.security.policy.PolicyService\r\n\r\nIn order to support the new Permissions.extendedRestriction\r\nclient-side checks, this commit adds a server-side interface,\r\nome.security.policy.PolicyService, which is configured with\r\ninstances of ome.security.policy.Policy. Similar to the JVM's\r\nSecurityManager and Permission objects, calling code can either\r\ncheck if a call *would* fail, or simply let the service raise\r\na SecurityViolation.\r\n\r\nCurrently, the only prototypical restriction policy in place\r\nis the DownloadPolicy.\r\n\r\ncc: @mtbc @aleksandra-tarkowska @chris-allan @imunro \r\n\r\n## Testing\r\n\r\n * Check that with this PR merged but no special configuration that all downloads continue to work\r\n * Disable all downloads:\r\n   * `bin/omero config set omero.policy.download none`\r\n   * check that **nothing** is downloadable\r\n   * e.g. `bin/omero upload some_file.txt && bin/omero download 32 -`\r\n   * note: **import** will also be broken. It may be that this is a useless config.\r\n * Set the repository setting:\r\n   * `bin/omero config set omero.policy.download repository`\r\n   * check that the owner of a file can download it\r\n   * but others in a `rwr---` or `rwra--` group can **not**"},"comment":{"url":"https://api.github.com/repos/openmicroscopy/openmicroscopy/issues/comments/77569364","html_url":"https://github.com/openmicroscopy/openmicroscopy/pull/3543#issuecomment-77569364","issue_url":"https://api.github.com/repos/openmicroscopy/openmicroscopy/issues/3543","id":77569364,"user":{"login":"pwalczysko","id":2478303,"avatar_url":"https://avatars.githubusercontent.com/u/2478303?v=3","gravatar_id":"","url":"https://api.github.com/users/pwalczysko","html_url":"https://github.com/pwalczysko","followers_url":"https://api.github.com/users/pwalczysko/followers","following_url":"https://api.github.com/users/pwalczysko/following{/other_user}","gists_url":"https://api.github.com/users/pwalczysko/gists{/gist_id}","starred_url":"https://api.github.com/users/pwalczysko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pwalczysko/subscriptions","organizations_url":"https://api.github.com/users/pwalczysko/orgs","repos_url":"https://api.github.com/users/pwalczysko/repos","events_url":"https://api.github.com/users/pwalczysko/events{/privacy}","received_events_url":"https://api.github.com/users/pwalczysko/received_events","type":"User","site_admin":false},"created_at":"2015-03-06T14:45:05Z","updated_at":"2015-03-06T14:45:05Z","body":"No objections. We will go through the download workflows next week."}}