{"action":"created","issue":{"url":"https://api.github.com/repos/tsuru/tsuru/issues/1278","labels_url":"https://api.github.com/repos/tsuru/tsuru/issues/1278/labels{/name}","comments_url":"https://api.github.com/repos/tsuru/tsuru/issues/1278/comments","events_url":"https://api.github.com/repos/tsuru/tsuru/issues/1278/events","html_url":"https://github.com/tsuru/tsuru/issues/1278","id":106780922,"number":1278,"title":"tsuru new authorization system","user":{"login":"andrewsmedina","id":52241,"avatar_url":"https://avatars.githubusercontent.com/u/52241?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewsmedina","html_url":"https://github.com/andrewsmedina","followers_url":"https://api.github.com/users/andrewsmedina/followers","following_url":"https://api.github.com/users/andrewsmedina/following{/other_user}","gists_url":"https://api.github.com/users/andrewsmedina/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewsmedina/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewsmedina/subscriptions","organizations_url":"https://api.github.com/users/andrewsmedina/orgs","repos_url":"https://api.github.com/users/andrewsmedina/repos","events_url":"https://api.github.com/users/andrewsmedina/events{/privacy}","received_events_url":"https://api.github.com/users/andrewsmedina/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/tsuru/tsuru/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":{"login":"cezarsa","id":11041,"avatar_url":"https://avatars.githubusercontent.com/u/11041?v=3","gravatar_id":"","url":"https://api.github.com/users/cezarsa","html_url":"https://github.com/cezarsa","followers_url":"https://api.github.com/users/cezarsa/followers","following_url":"https://api.github.com/users/cezarsa/following{/other_user}","gists_url":"https://api.github.com/users/cezarsa/gists{/gist_id}","starred_url":"https://api.github.com/users/cezarsa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cezarsa/subscriptions","organizations_url":"https://api.github.com/users/cezarsa/orgs","repos_url":"https://api.github.com/users/cezarsa/repos","events_url":"https://api.github.com/users/cezarsa/events{/privacy}","received_events_url":"https://api.github.com/users/cezarsa/received_events","type":"User","site_admin":false},"milestone":null,"comments":4,"created_at":"2015-09-16T14:06:18Z","updated_at":"2015-12-01T20:41:32Z","closed_at":"2015-12-01T13:19:01Z","body":"The goal is to change the authorization system to be more flexible based on `users`, `permissions` and `roles`.\r\nAn user can have more than one role, and a role can have one or more permissions.\r\n\r\nUse cases\r\n=========\r\n\r\nThese are examples of roles that the new authorization system should support:\r\n\r\nadmin\r\n-----\r\n\r\n* can do eveything\r\n* can create roles\r\n* can add and remove permissions in all roles\r\n* can add roles in users\r\n\r\ncloud manager\r\n-------------\r\n\r\n* can create pools\r\n* can add nodes to pools\r\n* can remove nodes\r\n* can't remove users\r\n* can't remove users from teams\r\n* cant remove apps from nodes\r\n* can add 'pool managers' to a specific pool\r\n\r\nteam leader in team 'x'\r\n-----------------------\r\n\r\n* can create users\r\n* can create team 'x'\r\n* can add and remove users (team membems) in team 'x'\r\n* can unlock team 'x' apps\r\n* can create team 'x' apps\r\n\r\nteam member in team 'x'\r\n-----------------------\r\n\r\n* can deploy in the team 'x' apps\r\n* can see team 'x' apps\r\n* can't remove team 'x' apps\r\n* can see members of team 'x'\r\n* can't add new users to team 'x'\r\n* can't remove users from team 'x'\r\n* can't create team 'x' apps\r\n\r\npool manager for pool 'z'\r\n-------------------------\r\n\r\n* can rebalance pool 'z'\r\n* can move unit between pool 'z' nodes \r\n* can see all apps in pool 'z'\r\n* can't remove apps in pool 'z'\r\n* can add units in pool 'z' apps\r\n\r\nservice manager\r\n---------------\r\n\r\n* can create new services\r\n* can view service instances related with its services\r\n* allow and disallow teams to use its services\r\n\r\nread only developer in app 'y\r\n-----------------------------\r\n\r\n* see app 'y'\r\n* view app 'y' logs, envs\r\n* can't set and unset envs in app 'y'\r\n* can''t make deploys in app 'y'\r\n\r\nHow to check permissions\r\n========================\r\n\r\n```\r\nfunc restart(w http.ResponseWriter, r *http.Request, t auth.Token) error {\r\n\t...\r\n\tpermissions.Check(t, \"app.update.restart\", []ContextIntance{\r\n\t\tpermissions.App{Name: appName},\r\n\t\tpermissions.Team{Teams: u.Teams()},\r\n\t\tpermissions.Pool{Name: instance.Pool},\r\n\t})\r\n\t...\r\n}\r\n```\r\n\r\nAdding permissions\r\n==================\r\n\r\n```\r\npackage permissions\r\n...\r\nr := register{}\r\nr.addWithContextCB(\"app\", []ContextType{App, Team, Pool}, func(r *register) {\r\n    r.addCB(\"update\", func(r *register) {\r\n        r.addCB(\"env\", func(r *register) {\r\n            r.add(\"set\", \"unset\")\r\n        })\r\n    })\r\n})\r\n```\r\n\r\nClient commands\r\n===============\r\n\r\n```\r\ntsuru role-add <role name> <context type>\r\ntsuru role-permission-add <role name> <permission name>\r\ntsuru user-role-add <role name> <context value>\r\n```\r\n\r\ne.g.\r\n```\r\ntsuru role-add team-member team\r\ntsuru role-permission-add team-member \"app.deploy\" \"app.update\"\r\ntsuru user-role-add myuser team-member teamA\r\n```"},"comment":{"url":"https://api.github.com/repos/tsuru/tsuru/issues/comments/161089220","html_url":"https://github.com/tsuru/tsuru/issues/1278#issuecomment-161089220","issue_url":"https://api.github.com/repos/tsuru/tsuru/issues/1278","id":161089220,"user":{"login":"fsouza","id":108725,"avatar_url":"https://avatars.githubusercontent.com/u/108725?v=3","gravatar_id":"","url":"https://api.github.com/users/fsouza","html_url":"https://github.com/fsouza","followers_url":"https://api.github.com/users/fsouza/followers","following_url":"https://api.github.com/users/fsouza/following{/other_user}","gists_url":"https://api.github.com/users/fsouza/gists{/gist_id}","starred_url":"https://api.github.com/users/fsouza/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fsouza/subscriptions","organizations_url":"https://api.github.com/users/fsouza/orgs","repos_url":"https://api.github.com/users/fsouza/repos","events_url":"https://api.github.com/users/fsouza/events{/privacy}","received_events_url":"https://api.github.com/users/fsouza/received_events","type":"User","site_admin":false},"created_at":"2015-12-01T20:41:32Z","updated_at":"2015-12-01T20:41:32Z","body":"woot."}}